Apache Subversion 'deadprops.c' Security Bypass Vulnerability

Bugtraq ID:	74259
Class:	Unknown
CVE:	CVE-2015-0251
Remote:	Yes
Local:	No
Published:	Apr 08 2015 12:00AM
Updated:	Oct 26 2016 01:16AM
Credit:	Ivan Zhakov, VisualSVN
Vulnerable:	Ubuntu Ubuntu Linux 15.04 Ubuntu Ubuntu Linux 14.04 LTS Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Redhat Enterprise Linux Workstation Optional 6 Redhat Enterprise Linux Workstation 6 Redhat Enterprise Linux Server Optional 6 Redhat Enterprise Linux Server 6 Redhat Enterprise Linux HPC Node Optional 6 Redhat Enterprise Linux Desktop Optional 6 Oracle Enterprise Linux 7 Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 CentOS CentOS 7 CentOS CentOS 6 Apple Xcode 6.0.1 Apple Xcode 2.4.1 Apple Xcode 6.3 Apple Xcode 6.2 Apple Xcode 6.0 Apple Xcode 5.0 Apple Xcode 4.4 Apple Xcode 4.3.3 Apple Xcode 4.3.2 Apple Xcode 4.3.1 Apple Xcode 4.3 Apple Xcode 4.2.1 Apple Xcode 4.2 Apple Xcode 4.1.1 Apple Xcode 4.0.2 Apple Xcode 4.0.1 Apple Xcode 3.2.5 Apple Xcode 3.2.4 Apple Xcode 3.2.3 Apple Xcode 3.2.2 Apple Xcode 3.2.1 Apple Xcode 3.1.4 Apple Xcode 3.1.3 Apple Xcode 3.1.2 Apple Xcode 3.1.1 Apple Xcode 3.1 Apple Xcode 3.0 Apple Xcode 2.3 Apple Xcode 2.2 Apple Xcode 2.1 Apple Xcode 2.0 Apple Mac Os X 10.10.5 Apple Mac Os X 10.10.4 Apache Subversion 1.8.11 Apache Subversion 1.8.10 Apache Subversion 1.8.9 Apache Subversion 1.8.5 Apache Subversion 1.8.1 Apache Subversion 1.8 Apache Subversion 1.7.19 Apache Subversion 1.7.18 Apache Subversion 1.7.17 Apache Subversion 1.7.16 Apache Subversion 1.7.11 Apache Subversion 1.7.10 Apache Subversion 1.7.1 Apache Subversion 1.7 Apache Subversion 1.6.23 Apache Subversion 1.6.22 Apache Subversion 1.6.21 Apache Subversion 1.6.20 Apache Subversion 1.6.19 Apache Subversion 1.6.18 Apache Subversion 1.6.14 Apache Subversion 1.6.13 Apache Subversion 1.6.12 Apache Subversion 1.6.11 Apache Subversion 1.6.10 Apache Subversion 1.6.6 Apache Subversion 1.6.5 Apache Subversion 1.6.3 Apache Subversion 1.6.2 Apache Subversion 1.5.8 Apache Subversion 1.5.7 Apache Subversion 1.5.5 Apache Subversion 1.5.4 Apache Subversion 1.5.2 Apache Subversion 1.5.1 Apache Subversion 1.8.8 Apache Subversion 1.8.7 Apache Subversion 1.8.6 Apache Subversion 1.8.4 Apache Subversion 1.8.3 Apache Subversion 1.8.2 Apache Subversion 1.7.15 Apache Subversion 1.7.14 Apache Subversion 1.7.13 Apache Subversion 1.7.12 Apache Subversion 1.6.9 Apache Subversion 1.6.8 Apache Subversion 1.6.7 Apache Subversion 1.6.4 Apache Subversion 1.6.17 Apache Subversion 1.6.16 Apache Subversion 1.6.15 Apache Subversion 1.6.0 Apache Subversion 1.5.6 Apache Subversion 1.5.0
Not Vulnerable:	Apple Xcode 7.0 Apache Subversion 1.8.13 Apache Subversion 1.7.20

Apache Subversion 'deadprops.c' Security Bypass Vulnerability

Apache Subversion is prone to a security-bypass vulnerability.

Successful exploits will allow an attacker to bypass certain security restrictions and perform unauthorized actions.

Apache Subversion 'deadprops.c' Security Bypass Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apache Subversion 'deadprops.c' Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Apache Subversion 'deadprops.c' Security Bypass Vulnerability

References:

• Apache Subversion Homepage (Apache Software Foundation)
  
• RHSA-2015:1742-1 Moderate: subversion security update (Red Hat)
  
• Subversion HTTP servers allow spoofing svn:author property values for new revi (Apache)