Alerts This Week
Warning Icon 1 485
Alerts This Week
Warning Icon 1 485

Ubuntu: USN-3388-1 Critical: Subversion Remote Code Execution and DoS

ubuntu
Calendar Grey August 11, 2017
Dist Ubuntu Esm H88
The Ubuntu Security Notice USN-3389-1 has been released, tackling various vulnerabilities in the Nginx server that impact numerous Ubuntu versions.
Several security issues were fixed in Subversion.

Summary

Several security issues were fixed in Subversion.

Software Description:

- subversion: Advanced version control system

Details:

Joern Schneeweisz discovered that Subversion did not properly handle

host names in 'svn+ssh://' URLs. A remote attacker could use this

to construct a subversion repository that when accessed could run

arbitrary code with the privileges of the user. (CVE-2017-9800)

Daniel Shahaf and James McCoy discovered that Subversion did not

properly verify realms when using Cyrus SASL authentication. A

remote attacker could use this to possibly bypass intended access

restrictions. This issue only affected Ubuntu 14.04 LTS and Ubuntu

16.04 LTS. (CVE-2016-2167)

Florian Weimer discovered that Subversion clients did not properly

restrict XML entity expansion when accessing http(s):// URLs. A remote

attacker could use this to cause a denial of service. This issue only

affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-8734)

Topics%20covered

Topics Covered

security advisory denial of service subversion critical remote code execution ubuntu access restriction

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 17.04:
  libsvn1                         1.9.5-1ubuntu1.1
  subversion                      1.9.5-1ubuntu1.1

Ubuntu 16.04 LTS:
  libapache2-mod-svn              1.9.3-2ubuntu1.1
  libapache2-svn                  1.9.3-2ubuntu1.1
  libsvn1                         1.9.3-2ubuntu1.1
  subversion                      1.9.3-2ubuntu1.1

Ubuntu 14.04 LTS:
  libapache2-mod-svn              1.8.8-1ubuntu3.3
  libapache2-svn                  1.8.8-1ubuntu3.3
  libsvn1                         1.8.8-1ubuntu3.3
  subversion                      1.8.8-1ubuntu3.3

In general, a standard system update will make all the necessary changes.

References

CVE-2016-2167, CVE-2016-8734, CVE-2017-9800

Severity
critical
Lowest
Low
Medium
High
Critical

August 11, 2017

Topics%20covered

Topics Covered

security advisory denial of service subversion critical remote code execution ubuntu access restriction

Package Information

https://launchpad.net/ubuntu/+source/subversion/1.9.5-1ubuntu1.1
https://launchpad.net/ubuntu/+source/subversion/1.9.3-2ubuntu1.1
https://launchpad.net/ubuntu/+source/subversion/1.8.8-1ubuntu3.3

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here