Re: Subversion 1.0.3 released. *SECURITY FIX*
Patrick Mayweg <[email protected]> Wed, 19 May 2004 14:07:48 +0200
| Newsgroups | gmane.mail.eyebrowse.devel,gmane.comp.version-control.subversion.announce |
|---|---|
| Message-ID | <[email protected]> |
The last version version of the javahl binding were build with an old neon version. Therefore I made a new release, which can be downloaded from: http://subversion.tigris.org/files/documents/15/13435/svn-win32-1.0.3_javahl_1.zip The MD5 checksum is: 4972d495df512a4c21fb4438e89a7c2a Sorry for any inconvinience my error caused. Patrick Patrick Mayweg wrote: > The javahl binding for Subversion 1.0.3 on Win32 is ready. Grab it from: > > > http://subversion.tigris.org/files/documents/15/13434/svn-win32-1.0.3_javahl.zip > > > The MD5 checksum is: > > 3fdc12912ed891901f8014927ee0a465 > > Patrick > > Ben Reser wrote: > >> Subversion 1.0.3 is ready. Grab it from: >> >> http://subversion.tigris.org/files/documents/15/13430/subversion-1.0.3.tar.gz >> >> http://subversion.tigris.org/files/documents/15/13432/subversion-1.0.3.tar.bz2 >> >> The MD5 checksums are: >> >> 1d5722a515be8f1aa6cfb779d99c6a11 subversion-1.0.3.tar.gz >> a8961f86a2bbd8deb59b2b62db303461 subversion-1.0.3.tar.bz2 >> >> >> Subversion versions up to and including 1.0.2 have a buffer overflow in >> the date parsing code. >> >> Both client and server are vulnerable. The server is vulnerable over >> both httpd/DAV and svnserve (that is, over http://, https://, svn://, >> svn+ssh:// and other tunneled svn+*:// methods). >> >> Additionally, clients with shared working copies, or permissions that >> allow files in the administrative area of the working copy to be >> written by other users, are potentially exploitable. >> >> Severity: >> ========= >> >> Severity ranges from "Denial of Service" to, potentially, "Arbitrary >> Code Execution", depending upon how skilled the attacker is and the >> ABI specifics of your platform. >> >> The server vulnerabilities can be triggered without write/commit access >> to the repository. So repositories with anonymous/public read access >> are vulnerable. >> >> Workarounds: >> ============ >> >> There are no workarounds except to disallow public access. Even then >> you'd still be vulnerable to attack by someone who still has access >> (perhaps you trust those people, though). >> >> Recommendations: >> ================ >> >> We recommend all users upgrade to 1.0.3. >> >> References: >> =========== >> >> CAN-2004-0397: subversion sscanf stack overflow via revision date >> in REPORT query >> >> Note: >> ===== >> >> There was a similar vulnerability in the Neon HTTP library up to and >> including version 0.24.5. Because Subversion ships with Neon, we have >> included (in Subversion 1.0.3) Neon 0.24.6, which is being released >> simultaneously. Subversion does not actually invoke the vulnerable code >> in Neon; we are updating our copy of Neon simply as a reassuring >> gesture, so people don't worry. See CAN-2004-0398 for details. >> >> Questions, comments, and bug reports to users_at_subversion.tigris.org. >> >> Thanks, >> -The Subversion Team >> --------------------8-<-------cut-here---------8-<----------------------- >> >> >> User-visible-changes: >> * fixed: security bug in date parsing. (CAN-2004-0397) >> >> >> --------------------------------------------------------------------- >> To unsubscribe, e-mail: [email protected] >> For additional commands, e-mail: [email protected] >> >> >> > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] >