Apache Subversion 'mod_dav_svn' Module SVNListParentPath Denial of Service Vulnerability

Bugtraq ID:	65434
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2014-0032
Remote:	Yes
Local:	No
Published:	Feb 07 2014 12:00AM
Updated:	Oct 26 2016 01:16AM
Credit:	Lieven Govaerts
Vulnerable:	Ubuntu Ubuntu Linux 14.04 LTS Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 SuSE SUSE Linux Enterprise Software Development Kit 11 SP3 + Linux kernel 2.6.5 SuSE Studio Onsite 1.3 Slackware Slackware Linux 14.1 Slackware Slackware Linux 14.0 S.u.S.E. openSUSE 12.3 Redhat Enterprise Linux Workstation Optional 6 Redhat Enterprise Linux Workstation 6 Redhat Enterprise Linux Server Optional 6 Redhat Enterprise Linux Server 6 Redhat Enterprise Linux HPC Node Optional 6 Redhat Enterprise Linux Desktop Workstation 5 client Redhat Enterprise Linux Desktop Optional 6 Redhat Enterprise Linux 5 Server Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 Mandriva Business Server 1 X86 64 Mandriva Business Server 1 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 Gentoo Linux CentOS CentOS 5 Apple Xcode 6.0 Apple Mac OS X 10.9.5 Apple Mac OS X 10.9.4 Apache Subversion 1.8.5 Apache Subversion 1.8.1 Apache Subversion 1.8 Apache Subversion 1.7.11 Apache Subversion 1.7.10 Apache Subversion 1.7.1 Apache Subversion 1.7 Apache Subversion 1.8.4 Apache Subversion 1.8.3 Apache Subversion 1.8.2 Apache Subversion 1.8.0 Apache Subversion 1.7.9 Apache Subversion 1.7.8 Apache Subversion 1.7.7 Apache Subversion 1.7.6 Apache Subversion 1.7.5 Apache Subversion 1.7.4 Apache Subversion 1.7.3 Apache Subversion 1.7.2 Apache Subversion 1.7.14 Apache Subversion 1.7.13 Apache Subversion 1.7.12 Apache Subversion 1.7.10 Apache Subversion 1.7.1 Apache Subversion 1.7.0
Not Vulnerable:	Apple Xcode 6.0.1 Apache Subversion 1.8.6 Apache Subversion 1.7.15

Apache Subversion 'mod_dav_svn' Module SVNListParentPath Denial of Service Vulnerability

Apache Subversion is prone to a denial-of-service vulnerability due to an error in the 'mod_dav_svn' module.

Attackers can exploit this issue to crash the application, denying further service to legitimate users.

Apache Subversion 'mod_dav_svn' Module SVNListParentPath Denial of Service Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apache Subversion 'mod_dav_svn' Module SVNListParentPath Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.


MandrakeSoft Enterprise Server 5 x86_64

• Mandriva apache-mod_dav_svn-1.7.16-0.1mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64svn0-1.7.16-0.1mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64svnjavahl1-1.7.16-0.1mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva perl-SVN-1.7.16-0.1mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva perl-svn-devel-1.7.16-0.1mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva python-svn-1.7.16-0.1mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva python-svn-devel-1.7.16-0.1mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva ruby-svn-1.7.16-0.1mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva ruby-svn-devel-1.7.16-0.1mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva subversion-1.7.16-0.1mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva subversion-devel-1.7.16-0.1mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva subversion-doc-1.7.16-0.1mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva subversion-server-1.7.16-0.1mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva subversion-tools-1.7.16-0.1mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva svn-javahl-1.7.16-0.1mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/

MandrakeSoft Enterprise Server 5

• Mandriva apache-mod_dav_svn-1.7.16-0.1mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva libsvn0-1.7.16-0.1mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva libsvnjavahl1-1.7.16-0.1mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva perl-SVN-1.7.16-0.1mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva perl-svn-devel-1.7.16-0.1mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva python-svn-1.7.16-0.1mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva python-svn-devel-1.7.16-0.1mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva ruby-svn-1.7.16-0.1mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva ruby-svn-devel-1.7.16-0.1mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva subversion-1.7.16-0.1mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva subversion-devel-1.7.16-0.1mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva subversion-doc-1.7.16-0.1mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva subversion-server-1.7.16-0.1mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva subversion-tools-1.7.16-0.1mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva svn-javahl-1.7.16-0.1mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/

Mandriva Business Server 1 X86 64

• Mandriva apache-mod_dav_svn-1.7.16-0.1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64svn-gnome-keyring0-1.7.16-0.1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64svn0-1.7.16-0.1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64svnjavahl1-1.7.16-0.1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva perl-SVN-1.7.16-0.1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva perl-svn-devel-1.7.16-0.1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva python-svn-1.7.16-0.1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva python-svn-devel-1.7.16-0.1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva ruby-svn-1.7.16-0.1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva ruby-svn-devel-1.7.16-0.1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva subversion-1.7.16-0.1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva subversion-devel-1.7.16-0.1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva subversion-doc-1.7.16-0.1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva subversion-gnome-keyring-devel-1.7.16-0.1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva subversion-server-1.7.16-0.1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva subversion-tools-1.7.16-0.1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva svn-javahl-1.7.16-0.1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/

Apache Subversion 'mod_dav_svn' Module SVNListParentPath Denial of Service Vulnerability

References:

• Apache Subversion Homepage (Apache Software Foundation)
  
• Segfault in mod_dav_svn with repositories on / (Lieven Govaerts)
  
• Subversion Version 1.7.15 (Apache Software Foundation)
  
• Subversion Version 1.8.6 (Apache Software Foundation)
  
• About the security content of Xcode 6.0.1 (Apple)