REDHAT-BUG-667407: Null Pointer Dereference
A NULL pointer dereference flaw was found in the way moddavsvn, Apache httpd module for Subversion server, processed certain requests to display collection of Subversion repositories, available on particular host, when listing of repositories (SVNListParentPath directive) was enabled. A remote user could use this flaw to cause denial of service (particular httpd thread crash).
References: [1] http://svn.apache.org/repos/asf/subversion/tags/1.6.15/CHANGES
Upstream changeset: [2] http://svn.apache.org/viewvc?view=revision&revision=1033166
Public PoC: [3] http://svn.haxx.se/users/archive-2010-11/0084.shtml
Flaw exploitation note: ----------------------- This flaw to be successfully exploited requires the "SVNListParentPath" directive / listing of repositories to be enabled. This feature is turned off by default in versions of subversion package, as shipped with Red Hat Enterprise Linux 5 and 6, which prevents occurrence / exploitation of this flaw.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-667407?
The severity of REDHAT-BUG-667407 is considered critical due to the potential for remote code execution and denial of service.
How do I fix REDHAT-BUG-667407?
To fix REDHAT-BUG-667407, you should update the Apache mod_dav_svn and Apache HTTP Server to the latest patched version.
Which versions of Apache are affected by REDHAT-BUG-667407?
REDHAT-BUG-667407 affects versions of Apache mod_dav_svn and Apache HTTP Server that have the SVNListParentPath directive enabled.
What causes the vulnerability REDHAT-BUG-667407?
REDHAT-BUG-667407 is caused by a NULL pointer dereference in mod_dav_svn when processing certain requests.
Is there a workaround for REDHAT-BUG-667407?
As a temporary workaround for REDHAT-BUG-667407, you can disable the SVNListParentPath directive if possible.