full-disclosure - [ MDVSA-2013:236 ] subversion

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <E1VLwWT-0004fx-99@titan.mandriva.com>
Date: Tue, 17 Sep 2013 16:45:00 +0200
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2013:236 ] subversion

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2013:236
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : subversion
 Date    : September 17, 2013
 Affected: Business Server 1.0, Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 Updated subversion package fixes security vulnerability:
 
 svnserve takes a --pid-file option which creates a file containing
 the process id it is running as. It does not take steps to ensure that
 the file it has been directed at is not a symlink. If the pid file is
 in a directory writeable by unprivileged users, the destination could
 be replaced by a symlink allowing for privilege escalation. svnserve
 does not create a pid file by default (CVE-2013-4277).
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4277
 http://advisories.mageia.org/MGASA-2013-0275.html
 _______________________________________________________________________

 Updated Packages:

 Mandriva Enterprise Server 5:
 f38b6d470f6b3abbbe3637f7db8f83bf  mes5/i586/apache-mod_dav_svn-1.7.13-0.1mdvmes5.2.i586.rpm
 79eaa7f7b5729e353eb2446dc5b785c4  mes5/i586/libsvn0-1.7.13-0.1mdvmes5.2.i586.rpm
 eced9a06a4b06c0043d0cc84c7134f34  mes5/i586/libsvnjavahl1-1.7.13-0.1mdvmes5.2.i586.rpm
 69de835ea0d3f19122dcebd6085150cb  mes5/i586/perl-SVN-1.7.13-0.1mdvmes5.2.i586.rpm
 da3fa6b9d3470c69f45f5ca095735e86  mes5/i586/perl-svn-devel-1.7.13-0.1mdvmes5.2.i586.rpm
 81b5d5fccd015dab9ba5a9bd1db1984a  mes5/i586/python-svn-1.7.13-0.1mdvmes5.2.i586.rpm
 5a02a46a08209eb00d171504979b40bc  mes5/i586/python-svn-devel-1.7.13-0.1mdvmes5.2.i586.rpm
 bb97e89d549dcb75c342790f3e98a21e  mes5/i586/ruby-svn-1.7.13-0.1mdvmes5.2.i586.rpm
 87de26a0718108205bf67d180ac741d2  mes5/i586/ruby-svn-devel-1.7.13-0.1mdvmes5.2.i586.rpm
 3408dd9520cd66e93545327de0ad9d64  mes5/i586/subversion-1.7.13-0.1mdvmes5.2.i586.rpm
 df5c215fe1fe39aaa4ee37f704f6e99a  mes5/i586/subversion-devel-1.7.13-0.1mdvmes5.2.i586.rpm
 865cb136fe8b7a60605d428c6a4334be  mes5/i586/subversion-doc-1.7.13-0.1mdvmes5.2.i586.rpm
 8a7f8f4c55c03782cc8bb3321dad0c47  mes5/i586/subversion-server-1.7.13-0.1mdvmes5.2.i586.rpm
 3d6705b4423dd9f6873a04937ede3161  mes5/i586/subversion-tools-1.7.13-0.1mdvmes5.2.i586.rpm
 963001ca144f80537d04527a12c2d104  mes5/i586/svn-javahl-1.7.13-0.1mdvmes5.2.i586.rpm 
 72de43be089762d25b7a138e5c846418  mes5/SRPMS/subversion-1.7.13-0.1mdvmes5.2.src.rpm

 Mandriva Enterprise Server 5/X86_64:
 cdd4e6d6349dd17625790619f60c8f07  mes5/x86_64/apache-mod_dav_svn-1.7.13-0.1mdvmes5.2.x86_64.rpm
 32fcd137383abb3e68295b810318d30b  mes5/x86_64/lib64svn0-1.7.13-0.1mdvmes5.2.x86_64.rpm
 3d8e646dce5faf522efa72b5a29b55f2  mes5/x86_64/lib64svnjavahl1-1.7.13-0.1mdvmes5.2.x86_64.rpm
 93e83a6648bd5b2c27ac199a0d2a08ed  mes5/x86_64/perl-SVN-1.7.13-0.1mdvmes5.2.x86_64.rpm
 844f66677639a071c1e1165fec0d81ef  mes5/x86_64/perl-svn-devel-1.7.13-0.1mdvmes5.2.x86_64.rpm
 d30cbade30979a3757b724a6c9ae133a  mes5/x86_64/python-svn-1.7.13-0.1mdvmes5.2.x86_64.rpm
 52a63621e29da829f54b8d3210b9e18c  mes5/x86_64/python-svn-devel-1.7.13-0.1mdvmes5.2.x86_64.rpm
 e7c15654ccd49e57eb1f8d4358d028d5  mes5/x86_64/ruby-svn-1.7.13-0.1mdvmes5.2.x86_64.rpm
 539a73b3f80f78ddbebaed77a3ae2497  mes5/x86_64/ruby-svn-devel-1.7.13-0.1mdvmes5.2.x86_64.rpm
 2e8e764515e3dbf65a411db72fab1660  mes5/x86_64/subversion-1.7.13-0.1mdvmes5.2.x86_64.rpm
 1e713f5ff21e66afe04f712b11caca84  mes5/x86_64/subversion-devel-1.7.13-0.1mdvmes5.2.x86_64.rpm
 7f32b4e7d8db8c3b73cbb4663613cb6f  mes5/x86_64/subversion-doc-1.7.13-0.1mdvmes5.2.x86_64.rpm
 f5bbfe6823d11b2d69e76b2f4b8d6962  mes5/x86_64/subversion-server-1.7.13-0.1mdvmes5.2.x86_64.rpm
 e6f00db7ff88ee9332124e62674da98f  mes5/x86_64/subversion-tools-1.7.13-0.1mdvmes5.2.x86_64.rpm
 968551d0705e89cc00a03ba94d341234  mes5/x86_64/svn-javahl-1.7.13-0.1mdvmes5.2.x86_64.rpm 
 72de43be089762d25b7a138e5c846418  mes5/SRPMS/subversion-1.7.13-0.1mdvmes5.2.src.rpm

 Mandriva Business Server 1/X86_64:
 15a554623be239cef5c1f8b32d9fec0f  mbs1/x86_64/apache-mod_dav_svn-1.7.13-0.1.mbs1.x86_64.rpm
 a0c7531ddfa472cae631ef7d843b45f4  mbs1/x86_64/lib64svn0-1.7.13-0.1.mbs1.x86_64.rpm
 2d7df851596596eb6307120c4f938d1f  mbs1/x86_64/lib64svn-gnome-keyring0-1.7.13-0.1.mbs1.x86_64.rpm
 caa80719005033a251fa612458881e0d  mbs1/x86_64/lib64svnjavahl1-1.7.13-0.1.mbs1.x86_64.rpm
 5722904c8dc97b9f9599f18b06788a3a  mbs1/x86_64/perl-SVN-1.7.13-0.1.mbs1.x86_64.rpm
 2cd8fe8824eb66f0cd923755e5cde1d8  mbs1/x86_64/perl-svn-devel-1.7.13-0.1.mbs1.x86_64.rpm
 fc2cd3e7aa5a1c6ff6839024ce21cc04  mbs1/x86_64/python-svn-1.7.13-0.1.mbs1.x86_64.rpm
 a6e4c1d28d11f68ef28b00cce7c30923  mbs1/x86_64/python-svn-devel-1.7.13-0.1.mbs1.x86_64.rpm
 29cf7fdd3e87513bd9d7de09819d6af1  mbs1/x86_64/ruby-svn-1.7.13-0.1.mbs1.x86_64.rpm
 f271e5772649d7ae2d38e7a56b085547  mbs1/x86_64/ruby-svn-devel-1.7.13-0.1.mbs1.x86_64.rpm
 dc62ebf26014691939c4ee2f2ecf2682  mbs1/x86_64/subversion-1.7.13-0.1.mbs1.x86_64.rpm
 ece2561d082b91449c6115b7c803e053  mbs1/x86_64/subversion-devel-1.7.13-0.1.mbs1.x86_64.rpm
 23836d4e6fd10ae59fbfa741883da2ff  mbs1/x86_64/subversion-doc-1.7.13-0.1.mbs1.x86_64.rpm
 bc2d6f0be3d16aff9d0a49f8b279ebe8  mbs1/x86_64/subversion-gnome-keyring-devel-1.7.13-0.1.mbs1.x86_64.rpm
 e3b8c167b97bced9ecea20280917cc2e  mbs1/x86_64/subversion-server-1.7.13-0.1.mbs1.x86_64.rpm
 54d71a7936c1304f7227689a55cf7504  mbs1/x86_64/subversion-tools-1.7.13-0.1.mbs1.x86_64.rpm
 0d5d041b96c18384951885829c9f8484  mbs1/x86_64/svn-javahl-1.7.13-0.1.mbs1.x86_64.rpm 
 8f29b3d96f1be7f22be000d1f6629a4a  mbs1/SRPMS/subversion-1.7.13-0.1.mbs1.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/en/support/security/advisories/

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFSOD76mqjQ0CJFipgRArF5AKCW4HD+MaGMPZcHu1LHNKGlRV1yDQCgiosL
1MsidUuX3l0EvAtvynFSnjA=
=oNo5
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/