現已提供適用於 Red Hat Enterprise Linux 5 和 6 的更新版 subversion 套件，可修正三個安全性問題。

Red Hat 安全性回應團隊已將此更新評等為具有中等安全性影響。可針對每個弱點從〈參照〉一節的 CVE 連結中取得常見弱點評分系統 (CVSS) 的基本分數，其中包含有關嚴重性評等的詳細資訊。

Subversion (SVN) 是並行版本控制系統，可讓一或多位使用者在開發及維護檔案與目錄階層時協同合作，同時保留所有變更的歷程記錄。mod_dav_svn 模組搭配使用 Apache HTTP Server，可透過 HTTP 存取 Subversion 存放庫。

mod_dav_svn 模組處理特定資料集的方式存在無限迴圈瑕疵。如果 SVNPathAuthz 指示詞設為「short_circuit」，且檔案和目錄的路徑型存取控制啟用，則惡意遠端使用者可利用此瑕疵，造成處理要求的 httpd 處理程序占用過多的系統記憶體。(CVE-2011-1783)

mod_dav_svn 模組處理針對基準化資源 URL 提交的要求的方式存在 NULL 指標解除參照瑕疵。惡意遠端使用者可利用此瑕疵，造成處理該要求的 httpd 處理程序損毀。(CVE-2011-1752)

如已啟用檔案和目錄的路徑型存取控制，會在 mod_dav_svn 模組處理特定 URL 的方式中發現一個資訊洩漏瑕疵。惡意遠端使用者可能會利用此瑕疵，存取以其他方式無法存取的特定存放庫檔案。注意：若將 SVNPathAuthz 指示詞設為「short_circuit」，則不會觸發此弱點。
(CVE-2011-1921)

Red Hat 要感謝 Apache Subversion 專案報告這些問題。上游確認 Apache Software Foundation 的 Joe Schaefer 為 CVE-2011-1752 的原始報告者；
VisualSVN 的 Ivan Zhakov 為 CVE-2011-1783 的原始報告者；
CollabNet, Inc. 的 Kamesh Jayachandran 為 CVE-2011-1921 的原始報告者。

所有 Subversion 使用者皆應升級至這些更新版套件，其中包含可更正這些問題的反向移植修補程式。如果使用的是 mod_dav_svn，安裝更新版套件後，必須先重新啟動 httpd 程序，更新才會生效。

在 Subversion (版本控制系統) 中發現數個弱點。Common Vulnerabilities and Exposures 專案發現下列問題：

- CVE-2011-1752 但是在要求傳遞基準化 WebDAV 資源時，mod_dav_svn Apache HTTPD 伺服器模組可損毀。

- CVE-2011-1783 mod_dav_svn Apache HTTPD 伺服器模組可觸發迴圈，從而消耗系統上所有可用的記憶體。

- CVE-2011-1921 mod_dav_svn Apache HTTPD 伺服器模組，可能將設定為遠端使用者無法讀取之檔案的檔案內容洩漏給那些使用者。

此更新包含最新版 Subversion，可修正三個安全性問題：

mod_dav_svn 模組處理特定資料集的方式存在無限迴圈瑕疵。如果 SVNPathAuthz 指示詞設為「short_circuit」，且檔案和目錄的路徑型存取控制啟用，則惡意遠端使用者可利用此瑕疵，造成處理要求的 httpd 處理程序占用過多的系統記憶體。(CVE-2011-1783)

mod_dav_svn 模組處理針對基準化資源 URL 提交的要求的方式存在 NULL 指標解除參照瑕疵。惡意遠端使用者可利用此瑕疵，造成處理該要求的 httpd 處理程序損毀。(CVE-2011-1752)

如已啟用檔案和目錄的路徑型存取控制，會在 mod_dav_svn 模組處理特定 URL 的方式中發現一個資訊洩漏瑕疵。惡意遠端使用者可能會利用此瑕疵，存取以其他方式無法存取的特定存放庫檔案。注意：若將 SVNPathAuthz 指示詞設為「short_circuit」，則不會觸發此弱點。
(CVE-2011-1921)

Fedora Project 要感謝 Apache Subversion 專案報告這些問題。上游確認 Apache Software Foundation 的 Joe Schaefer 為 CVE-2011-1752 的原始報告者；
VisualSVN 的 Ivan Zhakov 為 CVE-2011-1783 的原始報告者；
CollabNet, Inc. 的 Kamesh Jayachandran 為 CVE-2011-1921 的原始報告者。

以下錯誤亦已在此版本中修正：

- 使「blame -g」在具有大型 mergeinfo 時更有效率

- 保留具有非零編輯器結束的記錄訊息

- 修正 64 位元平台上的 FSFS 快取效能

- 使 svn 清理容許受到妨礙的目錄

- 修正為 FSFS 存放庫提供服務的多執行緒伺服器中的鎖死

- 偵測偶爾發生的損毀並中止認可

- 已修正：檔案外部造成不可繼承的 mergeinfo

- 已修正：檔案外部造成 mixed-revision 工作複本

- 已修正：直接寫入 proxy 可直接造成從屬

- 偵測 FSFS 中的特定損毀狀況

- 改善用戶端參照未知修正時出現的錯誤訊息

- DAV 鏡像程式碼的錯誤修正和最佳化

- 已修正：已鎖定及刪除的檔案造成樹狀結構衝突

- 已修正：更新具有 svn:keywords 內容的 touches 鎖定檔案

- 修正目錄 copyfrom 的 svnsync 處理

- 修正「log -g」過度的重複輸出

- 透過 BDB 修正 svnsync copyfrom 處理錯誤

- 認可期間，svn:mergeinfo 語法的伺服器端驗證

請注意，Tenable Network Security 已直接從 Fedora 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

遠端主機執行的 Mac OS X 10.6 版本並未套用安全性更新 2012-001。此項更新包含下列元件的多項安全性相關修正：

- Apache
 - ATS
 - ColorSync
 - CoreAudio
 - CoreMedia
 - CoreText
 - curl
 - Data Security
 - dovecot
 - filecmds
 - libresolv
 - libsecurity
 - OpenGL
 - PHP
 - QuickTime
 - SquirrelMail
 - Subversion
 - Tomcat
 - X11

Subversion team reports :

Subversion's mod_dav_svn Apache HTTPD server module will dereference a NULL pointer if asked to deliver baselined WebDAV resources.

This can lead to a DoS. An exploit has been tested, and tools or users have been observed triggering this problem in the wild.

Subversion's mod_dav_svn Apache HTTPD server module may in certain scenarios enter a logic loop which does not exit and which allocates memory in each iteration, ultimately exhausting all the available memory on the server.

This can lead to a DoS. There are no known instances of this problem being observed in the wild, but an exploit has been tested.

Subversion's mod_dav_svn Apache HTTPD server module may leak to remote users the file contents of files configured to be unreadable by those users.

There are no known instances of this problem being observed in the wild, but an exploit has been tested.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0862 advisory.

  - subversion (mod_dav_svn): DoS (crash) via request to deliver baselined WebDAV resources (CVE-2011-1752)

  - subversion (mod_dav_svn): DoS (excessive memory use) when configured to provide path-based access control     (CVE-2011-1783)

  - subversion (mod_dav_svn): File contents disclosure of files configured to be unreadable by those users     (CVE-2011-1921)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in Subversion, the version control system. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2011-1752     The mod_dav_svn Apache HTTPD server module can be     crashed though when asked to deliver baselined WebDAV     resources.

  - CVE-2011-1783     The mod_dav_svn Apache HTTPD server module can trigger a     loop which consumes all available memory on the system.

  - CVE-2011-1921     The mod_dav_svn Apache HTTPD server module may leak to     remote users the file contents of files configured to be     unreadable by those users.

This update includes the latest release of Subversion, fixing three security issues :

An infinite loop flaw was found in the way the mod_dav_svn module processed certain data sets. If the SVNPathAuthz directive was set to 'short_circuit', and path-based access control for files and directories was enabled, a malicious, remote user could use this flaw to cause the httpd process serving the request to consume an excessive amount of system memory. (CVE-2011-1783)

A NULL pointer dereference flaw was found in the way the mod_dav_svn module processed requests submitted against the URL of a baselined resource. A malicious, remote user could use this flaw to cause the httpd process serving the request to crash. (CVE-2011-1752)

An information disclosure flaw was found in the way the mod_dav_svn module processed certain URLs when path-based access control for files and directories was enabled. A malicious, remote user could possibly use this flaw to access certain files in a repository that would otherwise not be accessible to them. Note: This vulnerability cannot be triggered if the SVNPathAuthz directive is set to 'short_circuit'.
(CVE-2011-1921)

The Fedora Project would like to thank the Apache Subversion project for reporting these issues. Upstream acknowledges Joe Schaefer of the Apache Software Foundation as the original reporter of CVE-2011-1752;
Ivan Zhakov of VisualSVN as the original reporter of CVE-2011-1783;
and Kamesh Jayachandran of CollabNet, Inc. as the original reporter of CVE-2011-1921.

The following bugs are also fixed in this release :

  - make 'blame -g' more efficient on with large mergeinfo

    - preserve log message with a non-zero editor exit

    - fix FSFS cache performance on 64-bit platforms

    - make svn cleanup tolerate obstructed directories

    - fix deadlock in multithreaded servers serving FSFS       repositories

    - detect very occasional corruption and abort commit

    - fixed: file externals cause non-inheritable mergeinfo

    - fixed: file externals cause mixed-revision working       copies

    - fixed: write-through proxy could direcly commit to       slave

    - detect a particular corruption condition in FSFS

    - improve error message when clients refer to unkown       revisions

    - bugfixes and optimizations to the DAV mirroring code

    - fixed: locked and deleted file causes tree conflict

    - fixed: update touches locked file with svn:keywords       property

    - fix svnsync handling of directory copyfrom

    - fix 'log -g' excessive duplicate output

    - fix svnsync copyfrom handling bug with BDB

    - server-side validation of svn:mergeinfo syntax during       commit

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. The mod_dav_svn module is used with the Apache HTTP Server to allow access to Subversion repositories via HTTP.

An infinite loop flaw was found in the way the mod_dav_svn module processed certain data sets. If the SVNPathAuthz directive was set to 'short_circuit', and path-based access control for files and directories was enabled, a malicious, remote user could use this flaw to cause the httpd process serving the request to consume an excessive amount of system memory. (CVE-2011-1783)

A NULL pointer dereference flaw was found in the way the mod_dav_svn module processed requests submitted against the URL of a baselined resource. A malicious, remote user could use this flaw to cause the httpd process serving the request to crash. (CVE-2011-1752)

An information disclosure flaw was found in the way the mod_dav_svn module processed certain URLs when path-based access control for files and directories was enabled. A malicious, remote user could possibly use this flaw to access certain files in a repository that would otherwise not be accessible to them. Note: This vulnerability cannot be triggered if the SVNPathAuthz directive is set to 'short_circuit'.
(CVE-2011-1921)

All Subversion users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, you must restart the httpd daemon, if you are using mod_dav_svn, for the update to take effect.

The remote host is running a version of Mac OS X 10.6 that does not have Security Update 2012-001 applied. This update contains multiple security-related fixes for the following components :

  - Apache
  - ATS
  - ColorSync
  - CoreAudio
  - CoreMedia
  - CoreText
  - curl
  - Data Security
  - dovecot
  - filecmds
  - libresolv
  - libsecurity
  - OpenGL
  - PHP
  - QuickTime
  - SquirrelMail
  - Subversion
  - Tomcat
  - X11

The remote host is running a version of Mac OS X 10.7 that is older than version 10.7.3.  The newer version contains numerous security-related fixes for the following components :

  - Address Book
  - Apache
  - ATS
  - CFNetwork
 - CoreMedia
 - CoreText
 - CoreUI
 - curl
 - Data Security
 - dovecot
 - filecmds
 - ImageIO
 - Internet Sharing
 - Libinfo
 - libresolv
 - libsecurity
 - OpenGL
 - PHP
 - QuickTime
 - Subversion
 - Time Machine
 - WebDAV Sharing
 - Webmail
 - X11

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
55016	RHEL 5 / 6：subversion (RHSA-2011:0862)	Nessus	Red Hat Local Security Checks	2011/6/9	2024/4/27	high
55039	Debian DSA-2251-1 : subversion - 數個弱點	Nessus	Debian Local Security Checks	2011/6/10	2021/1/4	medium
55412	Fedora 15：subversion-1.6.17-1.fc15 (2011-8352)	Nessus	Fedora Local Security Checks	2011/6/24	2021/1/11	medium
57798	Mac OS X 多個弱點 (安全性更新 2012-001) (BEAST)	Nessus	MacOS X Local Security Checks	2012/2/2	2024/5/28	critical
54952	FreeBSD : Subversion -- multiple vulnerabilities (e27a1af3-8d21-11e0-a45d-001e8c75030d)	Nessus	FreeBSD Local Security Checks	2011/6/3	2021/1/6	medium
55016	RHEL 5 / 6 : subversion (RHSA-2011:0862)	Nessus	Red Hat Local Security Checks	2011/6/9	2024/4/27	high
55039	Debian DSA-2251-1 : subversion - several vulnerabilities	Nessus	Debian Local Security Checks	2011/6/10	2021/1/4	medium
55412	Fedora 15 : subversion-1.6.17-1.fc15 (2011-8352)	Nessus	Fedora Local Security Checks	2011/6/24	2021/1/11	medium
61067	Scientific Linux Security Update : subversion on SL5.x, SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
57798	Mac OS X Multiple Vulnerabilities (Security Update 2012-001) (BEAST)	Nessus	MacOS X Local Security Checks	2012/2/2	2024/5/28	critical
6303	Mac OS X 10.7 < 10.7.3 Multiple Vulnerabilities	Nessus Network Monitor	Generic	2012/2/6	2019/3/6	critical

检测

插件搜索

high

medium

medium

critical

medium

high

medium

medium

medium

critical

critical