CVE-2013-1849: Null Pointer Dereference
It was found that Subversion's moddavsvn Apache HTTPD server module will crash when a PROPFIND request is made against activity URLs. This can lead to a DoS.
There is a flaw in moddavsvn that improperly tries to process this request instead of rejecting it and results in an attempt to access invalid memory (NULL). Which results in the httpd process segfaulting and dying. How bad the impact of that is varies based upon the configuration of the httpd server. httpd servers using a prefork MPM will simply start a new process to replace the process that died. Servers using threaded MPMs may be processing other requests in the same process as the process that the attack causes to die. In either case there is an increased processing impact of restarting a process and the cost of per process caches being lost.
Other sources
The moddavsvn Apache HTTPD server module in Subversion 1.6.x through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a PROPFIND request for an activity URL.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1849?
CVE-2013-1849 has been assessed with a severity level that indicates it can lead to a denial of service (DoS) condition.
How do I fix CVE-2013-1849?
To fix CVE-2013-1849, upgrade to Subversion versions 1.6.21 or 1.7.9 or later.
Which software is affected by CVE-2013-1849?
CVE-2013-1849 affects multiple versions of Subversion, specifically versions prior to 1.6.21 and 1.7.9.
What type of issue is caused by CVE-2013-1849?
CVE-2013-1849 causes a crash of the mod_dav_svn component when processing PROPFIND requests against specific URLs.
Is there a known exploit for CVE-2013-1849?
There have been reports indicating that CVE-2013-1849 can be exploited to induce denial of service conditions.