Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 524
Alerts This Week
Warning Icon 1 524

Ubuntu 12.04 ESM USN-3388-2 Critical: Subversion Access Issues

ubuntu
Calendar Grey October 24, 2017
Scroller Ubuntu
Multiple vulnerabilities affecting Subversion have been rectified in Ubuntu 12.04 ESM, along with guidelines for applying the updates.
Several security issues were fixed in Subversion.

Summary

Several security issues were fixed in Subversion.

Software Description:

- subversion: Advanced version control system

Details:

USN-3388-1 fixed several vulnerabilities in Subversion. This update

provides the corresponding update for Ubuntu 12.04 ESM.

Ivan Zhakov discovered that Subversion did not properly handle

some requests. A remote attacker could use this to cause a

denial of service. (CVE-2016-2168)

Original advisory details:

 Joern Schneeweisz discovered that Subversion did not properly handle

 host names in 'svn+ssh://' URLs. A remote attacker could use this

 to construct a subversion repository that when accessed could run

 arbitrary code with the privileges of the user. (CVE-2017-9800)

 Daniel Shahaf and James McCoy discovered that Subversion did not

 properly verify realms when using Cyrus SASL authentication. A

 remote attacker could use this to possibly bypass intended access

 restrictions. (CVE-2016-2167)

Topics%20covered

Topics Covered

security advisory denial of service subversion access control ubuntu 12.04

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 ESM:
  libapache2-svn                  1.6.17dfsg-3ubuntu3.7
  libsvn1                         1.6.17dfsg-3ubuntu3.7
  subversion                      1.6.17dfsg-3ubuntu3.7

In general, a standard system update will make all the necessary
changes.

References

  https://ubuntu.com/security/notices/USN-3388-2

  https://ubuntu.com/security/notices/USN-3388-1

  CVE-2016-2167, CVE-2016-2168, CVE-2017-9800

Severity
critical
Lowest
Low
Medium
High
Critical

October 24, 2017

Topics%20covered

Topics Covered

security advisory denial of service subversion access control ubuntu 12.04

Package Information

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.