1. CVE-Search
  2. CVE-2013-1849
ID CVE-2013-1849
Summary The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a PROPFIND request for an activity URL. Per: http://cwe.mitre.org/data/definitions/476.html 'CWE-476: NULL Pointer Dereference'
References
Vulnerable Configurations
  • cpe:2.3:a:apache:subversion:1.6.0:*:*:*:*:*:*:*
    cpe:2.3:a:apache:subversion:1.6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:subversion:1.6.1:*:*:*:*:*:*:*
    cpe:2.3:a:apache:subversion:1.6.1:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:subversion:1.6.2:*:*:*:*:*:*:*
    cpe:2.3:a:apache:subversion:1.6.2:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:subversion:1.6.3:*:*:*:*:*:*:*
    cpe:2.3:a:apache:subversion:1.6.3:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:subversion:1.6.4:*:*:*:*:*:*:*
    cpe:2.3:a:apache:subversion:1.6.4:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:subversion:1.6.5:*:*:*:*:*:*:*
    cpe:2.3:a:apache:subversion:1.6.5:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:subversion:1.6.6:*:*:*:*:*:*:*
    cpe:2.3:a:apache:subversion:1.6.6:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:subversion:1.6.7:*:*:*:*:*:*:*
    cpe:2.3:a:apache:subversion:1.6.7:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:subversion:1.6.8:*:*:*:*:*:*:*
    cpe:2.3:a:apache:subversion:1.6.8:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:subversion:1.6.9:*:*:*:*:*:*:*
    cpe:2.3:a:apache:subversion:1.6.9:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:subversion:1.6.10:*:*:*:*:*:*:*
    cpe:2.3:a:apache:subversion:1.6.10:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:subversion:1.6.11:*:*:*:*:*:*:*
    cpe:2.3:a:apache:subversion:1.6.11:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:subversion:1.6.12:*:*:*:*:*:*:*
    cpe:2.3:a:apache:subversion:1.6.12:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:subversion:1.6.13:*:*:*:*:*:*:*
    cpe:2.3:a:apache:subversion:1.6.13:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:subversion:1.6.14:*:*:*:*:*:*:*
    cpe:2.3:a:apache:subversion:1.6.14:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:subversion:1.6.15:*:*:*:*:*:*:*
    cpe:2.3:a:apache:subversion:1.6.15:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:subversion:1.6.16:*:*:*:*:*:*:*
    cpe:2.3:a:apache:subversion:1.6.16:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:subversion:1.6.17:*:*:*:*:*:*:*
    cpe:2.3:a:apache:subversion:1.6.17:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:subversion:1.6.18:*:*:*:*:*:*:*
    cpe:2.3:a:apache:subversion:1.6.18:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:subversion:1.6.19:*:*:*:*:*:*:*
    cpe:2.3:a:apache:subversion:1.6.19:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:subversion:1.6.20:*:*:*:*:*:*:*
    cpe:2.3:a:apache:subversion:1.6.20:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:subversion:1.7.0:*:*:*:*:*:*:*
    cpe:2.3:a:apache:subversion:1.7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:subversion:1.7.1:*:*:*:*:*:*:*
    cpe:2.3:a:apache:subversion:1.7.1:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:subversion:1.7.2:*:*:*:*:*:*:*
    cpe:2.3:a:apache:subversion:1.7.2:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:subversion:1.7.3:*:*:*:*:*:*:*
    cpe:2.3:a:apache:subversion:1.7.3:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:subversion:1.7.4:*:*:*:*:*:*:*
    cpe:2.3:a:apache:subversion:1.7.4:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:subversion:1.7.5:*:*:*:*:*:*:*
    cpe:2.3:a:apache:subversion:1.7.5:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:subversion:1.7.6:*:*:*:*:*:*:*
    cpe:2.3:a:apache:subversion:1.7.6:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:subversion:1.7.7:*:*:*:*:*:*:*
    cpe:2.3:a:apache:subversion:1.7.7:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:subversion:1.7.8:*:*:*:*:*:*:*
    cpe:2.3:a:apache:subversion:1.7.8:*:*:*:*:*:*:*
CVSS
Base: 4.3 (as of 19-09-2017 - 01:36)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
cvss-vector via4 AV:N/AC:M/Au:N/C:N/I:N/A:P
oval via4
accepted 2015-05-04T04:00:12.997-04:00
class vulnerability
contributors
  • name Sergey Artykhov
    organization ALTX-SOFT
  • name Maria Mikhno
    organization ALTX-SOFT
definition_extensions
comment VisualSVN Server is installed
oval oval:org.mitre.oval:def:18636
description The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a PROPFIND request for an activity URL.
family windows
id oval:org.mitre.oval:def:18980
status accepted
submitted 2013-10-02T13:00:00
title Apache Subversion vulnerability 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 in VisualSVN Server (CVE-2013-1849)
version 8
redhat via4
advisories
bugzilla
id 929093
title CVE-2013-1849 Subversion (mod_dav_svn): DoS (crash) via PROPFIND request made against activity URLs
oval
OR
  • comment Red Hat Enterprise Linux must be installed
    oval oval:com.redhat.rhba:tst:20070304026
  • AND
    • comment Red Hat Enterprise Linux 5 is installed
      oval oval:com.redhat.rhba:tst:20070331005
    • OR
      • AND
        • comment mod_dav_svn is earlier than 0:1.6.11-11.el5_9
          oval oval:com.redhat.rhsa:tst:20130737001
        • comment mod_dav_svn is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhea:tst:20110039002
      • AND
        • comment subversion is earlier than 0:1.6.11-11.el5_9
          oval oval:com.redhat.rhsa:tst:20130737003
        • comment subversion is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhea:tst:20110039004
      • AND
        • comment subversion-devel is earlier than 0:1.6.11-11.el5_9
          oval oval:com.redhat.rhsa:tst:20130737005
        • comment subversion-devel is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhea:tst:20110039006
      • AND
        • comment subversion-javahl is earlier than 0:1.6.11-11.el5_9
          oval oval:com.redhat.rhsa:tst:20130737007
        • comment subversion-javahl is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhea:tst:20110039008
      • AND
        • comment subversion-perl is earlier than 0:1.6.11-11.el5_9
          oval oval:com.redhat.rhsa:tst:20130737009
        • comment subversion-perl is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhea:tst:20110039010
      • AND
        • comment subversion-ruby is earlier than 0:1.6.11-11.el5_9
          oval oval:com.redhat.rhsa:tst:20130737011
        • comment subversion-ruby is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhea:tst:20110039012
  • AND
    • comment Red Hat Enterprise Linux 6 is installed
      oval oval:com.redhat.rhba:tst:20111656003
    • OR
      • AND
        • comment mod_dav_svn is earlier than 0:1.6.11-9.el6_4
          oval oval:com.redhat.rhsa:tst:20130737014
        • comment mod_dav_svn is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110258002
      • AND
        • comment subversion is earlier than 0:1.6.11-9.el6_4
          oval oval:com.redhat.rhsa:tst:20130737016
        • comment subversion is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110258004
      • AND
        • comment subversion-devel is earlier than 0:1.6.11-9.el6_4
          oval oval:com.redhat.rhsa:tst:20130737018
        • comment subversion-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110258006
      • AND
        • comment subversion-gnome is earlier than 0:1.6.11-9.el6_4
          oval oval:com.redhat.rhsa:tst:20130737020
        • comment subversion-gnome is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110258008
      • AND
        • comment subversion-javahl is earlier than 0:1.6.11-9.el6_4
          oval oval:com.redhat.rhsa:tst:20130737022
        • comment subversion-javahl is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110258010
      • AND
        • comment subversion-kde is earlier than 0:1.6.11-9.el6_4
          oval oval:com.redhat.rhsa:tst:20130737024
        • comment subversion-kde is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110258012
      • AND
        • comment subversion-perl is earlier than 0:1.6.11-9.el6_4
          oval oval:com.redhat.rhsa:tst:20130737026
        • comment subversion-perl is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110258014
      • AND
        • comment subversion-ruby is earlier than 0:1.6.11-9.el6_4
          oval oval:com.redhat.rhsa:tst:20130737028
        • comment subversion-ruby is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110258016
      • AND
        • comment subversion-svn2cl is earlier than 0:1.6.11-9.el6_4
          oval oval:com.redhat.rhsa:tst:20130737030
        • comment subversion-svn2cl is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110258018
rhsa
id RHSA-2013:0737
released 2013-04-11
severity Moderate
title RHSA-2013:0737: subversion security update (Moderate)
rpms
  • mod_dav_svn-0:1.6.11-11.el5_9
  • mod_dav_svn-0:1.6.11-9.el6_4
  • subversion-0:1.6.11-11.el5_9
  • subversion-0:1.6.11-9.el6_4
  • subversion-debuginfo-0:1.6.11-11.el5_9
  • subversion-debuginfo-0:1.6.11-9.el6_4
  • subversion-devel-0:1.6.11-11.el5_9
  • subversion-devel-0:1.6.11-9.el6_4
  • subversion-gnome-0:1.6.11-9.el6_4
  • subversion-javahl-0:1.6.11-11.el5_9
  • subversion-javahl-0:1.6.11-9.el6_4
  • subversion-kde-0:1.6.11-9.el6_4
  • subversion-perl-0:1.6.11-11.el5_9
  • subversion-perl-0:1.6.11-9.el6_4
  • subversion-ruby-0:1.6.11-11.el5_9
  • subversion-ruby-0:1.6.11-9.el6_4
  • subversion-svn2cl-0:1.6.11-9.el6_4
refmap via4
confirm
fulldisc 20130305 Apache Subversion mod_dav_svn DoS via MKACTIVITY/PROPFIND
mandriva MDVSA-2013:153
mlist
  • [subversion-announce] 20130404 Apache Subversion 1.7.9 released
  • [subversion-announce] 20130404 Subversion 1.6.21 released
suse
  • openSUSE-SU-2013:0687
  • openSUSE-SU-2013:0932
ubuntu USN-1893-1
Last major update 19-09-2017 - 01:36
Published 02-05-2013 - 14:55
Last modified 19-09-2017 - 01:36
Back to Top