Re: Subversion 1.0.3 released. *SECURITY FIX*

The javahl binding for Subversion 1.0.3 on Win32 is ready. Grab it from:

  
http://subversion.tigris.org/files/documents/15/13434/svn-win32-1.0.3_javahl.zip

The MD5 checksum is:

  3fdc12912ed891901f8014927ee0a465

Patrick

Ben Reser wrote:

>Subversion 1.0.3 is ready. Grab it from:
>
>  http://subversion.tigris.org/files/documents/15/13430/subversion-1.0.3.tar.gz
>  http://subversion.tigris.org/files/documents/15/13432/subversion-1.0.3.tar.bz2 
>
>The MD5 checksums are:
>
>  1d5722a515be8f1aa6cfb779d99c6a11  subversion-1.0.3.tar.gz
>  a8961f86a2bbd8deb59b2b62db303461  subversion-1.0.3.tar.bz2
>
>
>Subversion versions up to and including 1.0.2 have a buffer overflow in
>the date parsing code.
>
>Both client and server are vulnerable.  The server is vulnerable over
>both httpd/DAV and svnserve (that is, over http://, https://, svn://,
>svn+ssh:// and other tunneled svn+*:// methods).
>
>Additionally, clients with shared working copies, or permissions that
>allow files in the administrative area of the working copy to be
>written by other users, are potentially exploitable.
>
>Severity:
>=========
>
>Severity ranges from "Denial of Service" to, potentially, "Arbitrary
>Code Execution", depending upon how skilled the attacker is and the
>ABI specifics of your platform.
>
>The server vulnerabilities can be triggered without write/commit access
>to the repository.  So repositories with anonymous/public read access
>are vulnerable.
>
>Workarounds:
>============
>
>There are no workarounds except to disallow public access.  Even then
>you'd still be vulnerable to attack by someone who still has access
>(perhaps you trust those people, though).
>
>Recommendations:
>================
>
>We recommend all users upgrade to 1.0.3.
>
>References:
>===========
>
>CAN-2004-0397: subversion sscanf stack overflow via revision date
>               in REPORT query
>
>Note:
>=====
>
>There was a similar vulnerability in the Neon HTTP library up to and
>including version 0.24.5.  Because Subversion ships with Neon, we have
>included (in Subversion 1.0.3) Neon 0.24.6, which is being released
>simultaneously.  Subversion does not actually invoke the vulnerable code
>in Neon; we are updating our copy of Neon simply as a reassuring
>gesture, so people don't worry.  See CAN-2004-0398 for details.
>
>Questions, comments, and bug reports to users_at_subversion.tigris.org.
>
>Thanks,
>-The Subversion Team 
>
>--------------------8-<-------cut-here---------8-<-----------------------
>
> User-visible-changes:
> * fixed: security bug in date parsing. (CAN-2004-0397)
>
>
>---------------------------------------------------------------------
>To unsubscribe, e-mail: [email protected]
>For additional commands, e-mail: [email protected]
>
>  
>