—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1
Liebe Kolleginnen und Kollegen,
soeben erreichte uns nachfolgendes RedHat Security Advisory. Wir geben
diese Informationen unveraendert an Sie weiter.
CVE-2011-1752 – Schwachstelle in Subversion (mod_dav_svn)
Durch die spezielle Art von Ressourcen des Typs “baselined” kann es
vorkommen, dass das Apache-Modul mod_dav_svn beim Verarbeiten von
Anfragen versucht einen Zeiger auszuwerten, der NULL ist. Ein entfernter
Angreifer kann dies fuer einen Denial of Service-Angriff ausnutzen,
indem er praeparierte Anfragen erzeugt, die sich auf Ressourcen des Typs
“baselined” beziehen. Ein oeffentlicher Exploit ist bereits verfuegbar.
Betroffen sind die folgenden Software Pakete und Plattformen:
Paket subversion
Red Hat Enterprise Linux AS version 4 – i386, ia64, ppc, s390, s390x,
x86_64
Red Hat Enterprise Linux Desktop version 4 – i386, x86_64
Red Hat Enterprise Linux ES version 4 – i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 – i386, ia64, x86_64
Vom Hersteller werden ueberarbeitete Pakete zur Verfuegung gestellt.
(c) der deutschen Zusammenfassung bei DFN-CERT Services GmbH; die
Verbreitung, auch auszugsweise, ist nur unter Hinweis auf den Urheber,
DFN-CERT Services GmbH, und nur zu nicht kommerziellen Zwecken
gestattet.
Mit freundlichen Gruessen,
Detlev O. Matthies
– —
Detlev O. Matthies, M.Sc. (Incident Response Team)
DFN-CERT Services GmbH, https://www.dfn-cert.de, Phone +49 40 808077-590
Sitz / Register: Hamburg, AG Hamburg, HRB 88805, Ust-IdNr.: DE 232129737
Sachsenstrasse 5, 20097 Hamburg/Germany, CEO: Dr. Klaus-Peter Kossakowski
Automatische Warnmeldungen https://www.cert.dfn.de/autowarn
– —–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: subversion security update
Advisory ID: RHSA-2011:0861-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2011-0861.html
Issue date: 2011-06-08
CVE Names: CVE-2011-1752
=====================================================================
1. Summary:
Updated subversion packages that fix one security issue are now available
for Red Hat Enterprise Linux 4.
The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS version 4 – i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 – i386, x86_64
Red Hat Enterprise Linux ES version 4 – i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 – i386, ia64, x86_64
3. Description:
Subversion (SVN) is a concurrent version control system which enables one
or more users to collaborate in developing and maintaining a hierarchy of
files and directories while keeping a history of all changes. The
mod_dav_svn module is used with the Apache HTTP Server to allow access to
Subversion repositories via HTTP.
A NULL pointer dereference flaw was found in the way the mod_dav_svn module
processed requests submitted against the URL of a baselined resource. A
malicious, remote user could use this flaw to cause the httpd process
serving the request to crash. (CVE-2011-1752)
Red Hat would like to thank the Apache Subversion project for reporting
this issue. Upstream acknowledges Joe Schaefer of the Apache Software
Foundation as the original reporter.
All Subversion users should upgrade to these updated packages, which
contain a backported patch to correct this issue. After installing the
updated packages, you must restart the httpd daemon, if you are using
mod_dav_svn, for the update to take effect.
4. Solution:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259
5. Bugs fixed (http://bugzilla.redhat.com/):
709111 – CVE-2011-1752 subversion (mod_dav_svn): DoS (crash) via request to deliver baselined WebDAV resources
6. Package List:
Red Hat Enterprise Linux AS version 4:
Source:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/subversion-1.1.4-4.el4.src.rpm
i386:
mod_dav_svn-1.1.4-4.el4.i386.rpm
subversion-1.1.4-4.el4.i386.rpm
subversion-debuginfo-1.1.4-4.el4.i386.rpm
subversion-devel-1.1.4-4.el4.i386.rpm
subversion-perl-1.1.4-4.el4.i386.rpm
ia64:
mod_dav_svn-1.1.4-4.el4.ia64.rpm
subversion-1.1.4-4.el4.ia64.rpm
subversion-debuginfo-1.1.4-4.el4.ia64.rpm
subversion-devel-1.1.4-4.el4.ia64.rpm
subversion-perl-1.1.4-4.el4.ia64.rpm
ppc:
mod_dav_svn-1.1.4-4.el4.ppc.rpm
subversion-1.1.4-4.el4.ppc.rpm
subversion-debuginfo-1.1.4-4.el4.ppc.rpm
subversion-devel-1.1.4-4.el4.ppc.rpm
subversion-perl-1.1.4-4.el4.ppc.rpm
s390:
mod_dav_svn-1.1.4-4.el4.s390.rpm
subversion-1.1.4-4.el4.s390.rpm
subversion-debuginfo-1.1.4-4.el4.s390.rpm
subversion-devel-1.1.4-4.el4.s390.rpm
subversion-perl-1.1.4-4.el4.s390.rpm
s390x:
mod_dav_svn-1.1.4-4.el4.s390x.rpm
subversion-1.1.4-4.el4.s390x.rpm
subversion-debuginfo-1.1.4-4.el4.s390x.rpm
subversion-devel-1.1.4-4.el4.s390x.rpm
subversion-perl-1.1.4-4.el4.s390x.rpm
x86_64:
mod_dav_svn-1.1.4-4.el4.x86_64.rpm
subversion-1.1.4-4.el4.x86_64.rpm
subversion-debuginfo-1.1.4-4.el4.x86_64.rpm
subversion-devel-1.1.4-4.el4.x86_64.rpm
subversion-perl-1.1.4-4.el4.x86_64.rpm
Red Hat Enterprise Linux Desktop version 4:
Source:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/subversion-1.1.4-4.el4.src.rpm
i386:
mod_dav_svn-1.1.4-4.el4.i386.rpm
subversion-1.1.4-4.el4.i386.rpm
subversion-debuginfo-1.1.4-4.el4.i386.rpm
subversion-devel-1.1.4-4.el4.i386.rpm
subversion-perl-1.1.4-4.el4.i386.rpm
x86_64:
mod_dav_svn-1.1.4-4.el4.x86_64.rpm
subversion-1.1.4-4.el4.x86_64.rpm
subversion-debuginfo-1.1.4-4.el4.x86_64.rpm
subversion-devel-1.1.4-4.el4.x86_64.rpm
subversion-perl-1.1.4-4.el4.x86_64.rpm
Red Hat Enterprise Linux ES version 4:
Source:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/subversion-1.1.4-4.el4.src.rpm
i386:
mod_dav_svn-1.1.4-4.el4.i386.rpm
subversion-1.1.4-4.el4.i386.rpm
subversion-debuginfo-1.1.4-4.el4.i386.rpm
subversion-devel-1.1.4-4.el4.i386.rpm
subversion-perl-1.1.4-4.el4.i386.rpm
ia64:
mod_dav_svn-1.1.4-4.el4.ia64.rpm
subversion-1.1.4-4.el4.ia64.rpm
subversion-debuginfo-1.1.4-4.el4.ia64.rpm
subversion-devel-1.1.4-4.el4.ia64.rpm
subversion-perl-1.1.4-4.el4.ia64.rpm
x86_64:
mod_dav_svn-1.1.4-4.el4.x86_64.rpm
subversion-1.1.4-4.el4.x86_64.rpm
subversion-debuginfo-1.1.4-4.el4.x86_64.rpm
subversion-devel-1.1.4-4.el4.x86_64.rpm
subversion-perl-1.1.4-4.el4.x86_64.rpm
Red Hat Enterprise Linux WS version 4:
Source:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/subversion-1.1.4-4.el4.src.rpm
i386:
mod_dav_svn-1.1.4-4.el4.i386.rpm
subversion-1.1.4-4.el4.i386.rpm
subversion-debuginfo-1.1.4-4.el4.i386.rpm
subversion-devel-1.1.4-4.el4.i386.rpm
subversion-perl-1.1.4-4.el4.i386.rpm
ia64:
mod_dav_svn-1.1.4-4.el4.ia64.rpm
subversion-1.1.4-4.el4.ia64.rpm
subversion-debuginfo-1.1.4-4.el4.ia64.rpm
subversion-devel-1.1.4-4.el4.ia64.rpm
subversion-perl-1.1.4-4.el4.ia64.rpm
x86_64:
mod_dav_svn-1.1.4-4.el4.x86_64.rpm
subversion-1.1.4-4.el4.x86_64.rpm
subversion-debuginfo-1.1.4-4.el4.x86_64.rpm
subversion-devel-1.1.4-4.el4.x86_64.rpm
subversion-perl-1.1.4-4.el4.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package
7. References:
https://www.redhat.com/security/data/cve/CVE-2011-1752.html
https://access.redhat.com/security/updates/classification/#moderate
http://subversion.apache.org/security/CVE-2011-1752-advisory.txt
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2011 Red Hat, Inc.
– —–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFN75jRXlSAg2UNWIIRAhdTAJ4iqHSh8afL2Y7yKRZasLsuAYDjfQCfbweY
dnCzZU0//sUiD+8AnvBYaO4=
=Ep0O
– —–END PGP SIGNATURE—–
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v2.0.16 (GNU/Linux)
iQEcBAEBAgAGBQJN8OanAAoJEJtyb8U7iGZBV64H/i5ufIUQ8eeLaDdubXSw3oZi
bi9W0I0ARCq7vQPwd8NiaJw5CNfkDx9GW+LWQiB3CEUyDIUtejzRChR1pqWDUliW
PRhAt0KRxI6cHyxADAhABDleeL3P0fFz+KGsG/RrSCqj/Za78G9Vh5LWPrdr0cni
SP8s7inY6WiZrCfEmjXksuIJtPHL39QzvIuO+oy37LNe/kQzU7lo1IfMRJET6bRW
YdR7Lcsa1b4+8rnmBqLOtYGTf28Jy1M+aGKI+CEHNud7HCW11Bnm1y7tEp6dIPg8
RC8554zlFO/AN8bwuFtasSEND6/golbDGf0r1uuHdvMs7weaW38nkOLgjeaj39E=
=C0wR
—–END PGP SIGNATURE—–
