Apache Subversion CVE-2014-3528 Insecure Authentication Weakness

Bugtraq ID:	68995
Class:	Unknown
CVE:	CVE-2014-3528
Remote:	Yes
Local:	No
Published:	Aug 01 2014 12:00AM
Updated:	Oct 26 2016 01:16AM
Credit:	Bert Huijben
Vulnerable:	Ubuntu Ubuntu Linux 14.04 LTS Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Oracle Enterprise Linux 7 Mandriva Business Server 1 X86 64 Mandriva Business Server 1 Gentoo Linux Apple Xcode 6.0.1 Apple Xcode 2.4.1 Apple Xcode 6.0 Apple Xcode 5.0 Apple Xcode 4.4 Apple Xcode 4.3.3 Apple Xcode 4.3.2 Apple Xcode 4.3.1 Apple Xcode 4.3 Apple Xcode 4.2.1 Apple Xcode 4.2 Apple Xcode 4.1.1 Apple Xcode 4.0.2 Apple Xcode 4.0.1 Apple Xcode 3.2.5 Apple Xcode 3.2.4 Apple Xcode 3.2.3 Apple Xcode 3.2.2 Apple Xcode 3.2.1 Apple Xcode 3.1.4 Apple Xcode 3.1.3 Apple Xcode 3.1.2 Apple Xcode 3.1.1 Apple Xcode 3.1 Apple Xcode 3.0 Apple Xcode 2.3 Apple Xcode 2.2 Apple Xcode 2.1 Apple Xcode 2.0 Apache Subversion 1.8.5 Apache Subversion 1.8.1 Apache Subversion 1.8 Apache Subversion 1.7.11 Apache Subversion 1.7.10 Apache Subversion 1.7.1 Apache Subversion 1.7 Apache Subversion 1.8.6 Apache Subversion 1.8.4 Apache Subversion 1.8.3 Apache Subversion 1.8.2 Apache Subversion 1.7.9 Apache Subversion 1.7.8 Apache Subversion 1.7.7 Apache Subversion 1.7.6 Apache Subversion 1.7.5 Apache Subversion 1.7.4 Apache Subversion 1.7.3 Apache Subversion 1.7.2 Apache Subversion 1.7.15 Apache Subversion 1.7.14 Apache Subversion 1.7.13 Apache Subversion 1.7.12
Not Vulnerable:	Apple Xcode 6.2

Apache Subversion CVE-2014-3528 Insecure Authentication Weakness

Apache Subversion is prone to an insecure authentication weakness.

A remote attacker can exploit this issue to obtain a user's authentication credentials. This may aid in further attacks.

Apache Subversion CVE-2014-3528 Insecure Authentication Weakness

An attacker can exploit this issue using readily available tools.

Apache Subversion CVE-2014-3528 Insecure Authentication Weakness

Solution:
Updates are available. Please see the references or vendor advisory for more information.


Mandriva Business Server 1 X86 64

• Mandriva apache-mod_dav_svn-1.7.18-1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64svn-gnome-keyring0-1.7.18-1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64svn0-1.7.18-1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64svnjavahl1-1.7.18-1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva perl-SVN-1.7.18-1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva perl-svn-devel-1.7.18-1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva python-svn-1.7.18-1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva python-svn-devel-1.7.18-1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva ruby-svn-1.7.18-1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva ruby-svn-devel-1.7.18-1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva subversion-1.7.18-1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva subversion-devel-1.7.18-1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva subversion-doc-1.7.18-1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva subversion-gnome-keyring-devel-1.7.18-1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva subversion-server-1.7.18-1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva subversion-tools-1.7.18-1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva svn-javahl-1.7.18-1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/

Apache Subversion CVE-2014-3528 Insecure Authentication Weakness

References:

• Apache Subversion Homepage (Apache Software Foundation)
  
• Possible CVE request: subversion MD5 collision authentication leak (Marcus Meissner)
  
• About the security content of Xcode 6.2 (Apple)