CVE-2004-0413: Buffer Overflow
libsvnrasvn in Subversion 1.0.4 trusts the length field of (1) svn://, (2) svn+ssh://, and (3) other svn protocol URL strings, which allows remote attackers to cause a denial of service (memory consumption) and possibly execute arbitrary code via an integer overflow that leads to a heap-based buffer overflow.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2004-0413?
CVE-2004-0413 has a severity rating that indicates it can potentially lead to denial of service and may allow remote code execution.
How do I fix CVE-2004-0413?
To fix CVE-2004-0413, upgrade Subversion to version 1.0.5 or later, which contains fixes for this vulnerability.
Which versions of Subversion are affected by CVE-2004-0413?
CVE-2004-0413 affects Subversion versions 1.0, 1.0.1, 1.0.2, 1.0.3, and 1.0.4.
What types of attacks can CVE-2004-0413 facilitate?
CVE-2004-0413 can facilitate denial of service through memory consumption and may lead to potential arbitrary code execution.
Is CVE-2004-0413 specific to any software besides Subversion?
Yes, CVE-2004-0413 also affects OpenPKG versions that incorporate vulnerable versions of Subversion.