CVE-2011-1752: Null Pointer Dereference
A NULL pointer dereference flaw was found in the way moddavsvn module of the subversion concurrent version control system processed requests submitted against the URL of a baselined resource. A remote attacker could use this flaw to cause the httpd child process to crash.
Acknowledgements:
Red Hat would like to thank the Apache Subversion project for reporting this issue. Upstream acknowledges Joe Schaefer of Apache Software Foundation as the original reporter.
Other sources
The moddavsvn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.17, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request for a baselined WebDAV resource, as exploited in the wild in May 2011.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1752?
CVE-2011-1752 is considered a moderate severity vulnerability due to its potential to crash the httpd child process.
How do I fix CVE-2011-1752?
To fix CVE-2011-1752, upgrade your Apache Subversion to version 1.6.17 or later.
Which versions of software are affected by CVE-2011-1752?
CVE-2011-1752 affects Apache Subversion versions prior to 1.6.17 across various operating systems.
Can CVE-2011-1752 be exploited remotely?
Yes, CVE-2011-1752 can be exploited remotely, allowing attackers to crash the server.
Is there a workaround for CVE-2011-1752?
While upgrading is the best solution, a temporary workaround may include restricting access to vulnerable resources.