CVE-2010-4539: Null Pointer Dereference
A NULL pointer dereference flaw was found in the way moddavsvn, Apache httpd module for Subversion server, processed certain requests to display collection of Subversion repositories, available on particular host, when listing of repositories (SVNListParentPath directive) was enabled. A remote user could use this flaw to cause denial of service (particular httpd thread crash).
References: [1] http://svn.apache.org/repos/asf/subversion/tags/1.6.15/CHANGES
Upstream changeset: [2] http://svn.apache.org/viewvc?view=revision&revision=1033166
Public PoC: [3] http://svn.haxx.se/users/archive-2010-11/0084.shtml
Flaw exploitation note: ----------------------- This flaw to be successfully exploited requires the "SVNListParentPath" directive / listing of repositories to be enabled. This feature is turned off by default in versions of subversion package, as shipped with Red Hat Enterprise Linux 5 and 6, which prevents occurrence / exploitation of this flaw.
Other sources
The walk function in repos.c in the moddavsvn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.15, allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger the walking of SVNParentPath collections.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-4539?
CVE-2010-4539 has a severity rating of medium due to the potential for remote code execution via NULL pointer dereference.
How do I fix CVE-2010-4539?
To fix CVE-2010-4539, update your Apache Subversion installation to version 1.6.14 or later.
What software versions are affected by CVE-2010-4539?
CVE-2010-4539 affects multiple versions of Apache Subversion, including 0.7.0 up to 1.6.14.
Can CVE-2010-4539 be exploited remotely?
Yes, CVE-2010-4539 can be exploited remotely under certain conditions where SVNListParentPath is enabled.
What type of vulnerability is CVE-2010-4539?
CVE-2010-4539 is classified as a NULL pointer dereference vulnerability.