Vulnerabilities > CVE-2004-0397 - Buffer Overflow vulnerability in Subversion 1.0/1.0.1/1.0.2

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
subversion
nessus
exploit available
metasploit

Summary

Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1.0.2 and earlier allows remote attackers to execute arbitrary code via a (1) DAV2 REPORT query or (2) get-dated-rev svn-protocol command.

Vulnerable Configurations

Part Description Count
Application
Subversion
3

Exploit-Db

  • descriptionSubversion 1.0.2 Date Overflow. CVE-2004-0397. Remote exploits for multiple platform
    idEDB-ID:9935
    last seen2016-02-01
    modified2004-05-19
    published2004-05-19
    reporterspoonm
    sourcehttps://www.exploit-db.com/download/9935/
    titleSubversion 1.0.2 - Date Overflow
  • descriptionSubversion Date Svnserve. CVE-2004-0397. Dos exploit for unix platform
    idEDB-ID:16284
    last seen2016-02-01
    modified2010-08-07
    published2010-08-07
    reportermetasploit
    sourcehttps://www.exploit-db.com/download/16284/
    titleSubversion Date Svnserve
  • descriptionSubversion 1.0.2 svn_time_from_cstring() Remote Exploit. CVE-2004-0397. Remote exploit for linux platform
    idEDB-ID:304
    last seen2016-01-31
    modified2004-06-25
    published2004-06-25
    reporterGyan Chawdhary
    sourcehttps://www.exploit-db.com/download/304/
    titleSubversion 1.0.2 - svn_time_from_cstring Remote Exploit

Metasploit

descriptionThis is an exploit for the Subversion date parsing overflow. This exploit is for the svnserve daemon (svn:// protocol) and will not work for Subversion over webdav (http[s]://). This exploit should never crash the daemon, and should be safe to do multi-hits. **WARNING** This exploit seems to (not very often, I've only seen it during testing) corrupt the subversion database, so be careful!
idMSF:EXPLOIT/MULTI/SVN/SVNSERVE_DATE
last seen2020-03-11
modified2017-07-24
published2007-01-05
references
reporterRapid7
sourcehttps://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/multi/svn/svnserve_date.rb
titleSubversion Date Svnserve

Nessus

  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2004-128.NASL
    descriptionStefan Esser discovered an issue in the date parsing routines in Subversion which allows a buffer overflow. An attacker could send malicious requests to a Subversion server (either Apache-based using mod_dav_svn, or using the svnserve daemon) and perform arbitrary execution of code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0397 to this issue. This update includes packages with a patch for this issue. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id13703
    published2004-07-23
    reporterThis script is Copyright (C) 2004-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/13703
    titleFedora Core 2 : subversion-1.0.2-2.1 (2004-128)
    code
    #%NASL_MIN_LEVEL 80502
    
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory 2004-128.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(13703);
      script_version ("1.17");
      script_cvs_date("Date: 2019/08/02 13:32:23");
    
      script_cve_id("CVE-2004-0397");
      script_xref(name:"FEDORA", value:"2004-128");
    
      script_name(english:"Fedora Core 2 : subversion-1.0.2-2.1 (2004-128)");
      script_summary(english:"Checks rpm output for the updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora Core host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Stefan Esser discovered an issue in the date parsing routines in
    Subversion which allows a buffer overflow. An attacker could send
    malicious requests to a Subversion server (either Apache-based using
    mod_dav_svn, or using the svnserve daemon) and perform arbitrary
    execution of code. 
    
    The Common Vulnerabilities and Exposures project (cve.mitre.org) has
    assigned the name CVE-2004-0397 to this issue. This update includes
    packages with a patch for this issue.
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      # https://lists.fedoraproject.org/pipermail/announce/2004-May/000132.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?887ce9e5"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Subversion Date Svnserve');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:mod_dav_svn");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:subversion");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:subversion-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:subversion-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:subversion-perl");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora_core:2");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2004/05/19");
      script_set_attribute(attribute:"plugin_publication_date", value:"2004/07/23");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2004-2019 Tenable Network Security, Inc.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! ereg(pattern:"^2([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 2.x", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    flag = 0;
    if (rpm_check(release:"FC2", reference:"mod_dav_svn-1.0.2-2.1")) flag++;
    if (rpm_check(release:"FC2", reference:"subversion-1.0.2-2.1")) flag++;
    if (rpm_check(release:"FC2", reference:"subversion-debuginfo-1.0.2-2.1")) flag++;
    if (rpm_check(release:"FC2", reference:"subversion-devel-1.0.2-2.1")) flag++;
    if (rpm_check(release:"FC2", reference:"subversion-perl-1.0.2-2.1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "mod_dav_svn / subversion / subversion-debuginfo / subversion-devel / etc");
    }
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2004-127.NASL
    descriptionStefan Esser discovered an issue in the date parsing routines in Subversion which allows a buffer overflow. An attacker could send malicious requests to a Subversion server (either Apache-based using mod_dav_svn, or using the svnserve daemon) and perform arbitrary execution of code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0397 to this issue. This update includes packages with a patch for this issue. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id13702
    published2004-07-23
    reporterThis script is Copyright (C) 2004-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/13702
    titleFedora Core 1 : subversion-0.32.1-2 (2004-127)
    code
    #%NASL_MIN_LEVEL 80502
    
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory 2004-127.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(13702);
      script_version ("1.17");
      script_cvs_date("Date: 2019/08/02 13:32:23");
    
      script_cve_id("CVE-2004-0397");
      script_xref(name:"FEDORA", value:"2004-127");
    
      script_name(english:"Fedora Core 1 : subversion-0.32.1-2 (2004-127)");
      script_summary(english:"Checks rpm output for the updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora Core host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Stefan Esser discovered an issue in the date parsing routines in
    Subversion which allows a buffer overflow. An attacker could send
    malicious requests to a Subversion server (either Apache-based using
    mod_dav_svn, or using the svnserve daemon) and perform arbitrary
    execution of code. 
    
    The Common Vulnerabilities and Exposures project (cve.mitre.org) has
    assigned the name CVE-2004-0397 to this issue. This update includes
    packages with a patch for this issue.
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      # https://lists.fedoraproject.org/pipermail/announce/2004-May/000131.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?618b8f54"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Subversion Date Svnserve');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:mod_dav_svn");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:subversion");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:subversion-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:subversion-devel");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora_core:1");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2004/05/19");
      script_set_attribute(attribute:"plugin_publication_date", value:"2004/07/23");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2004-2019 Tenable Network Security, Inc.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! ereg(pattern:"^1([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 1.x", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    flag = 0;
    if (rpm_check(release:"FC1", reference:"mod_dav_svn-0.32.1-2")) flag++;
    if (rpm_check(release:"FC1", reference:"subversion-0.32.1-2")) flag++;
    if (rpm_check(release:"FC1", reference:"subversion-debuginfo-0.32.1-2")) flag++;
    if (rpm_check(release:"FC1", reference:"subversion-devel-0.32.1-2")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "mod_dav_svn / subversion / subversion-debuginfo / subversion-devel");
    }
    
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-200405-14.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-200405-14 (Buffer overflow in Subversion) All releases of Subversion prior to 1.0.3 have a vulnerability in the date-parsing code. This vulnerability may allow denial of service or arbitrary code execution as the Subversion user. Both the client and server are vulnerable, and write access is NOT required to the server
    last seen2020-06-01
    modified2020-06-02
    plugin id14500
    published2004-08-30
    reporterThis script is Copyright (C) 2004-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/14500
    titleGLSA-200405-14 : Buffer overflow in Subversion
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Gentoo Linux Security Advisory GLSA 200405-14.
    #
    # The advisory text is Copyright (C) 2001-2018 Gentoo Foundation, Inc.
    # and licensed under the Creative Commons - Attribution / Share Alike 
    # license. See http://creativecommons.org/licenses/by-sa/3.0/
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(14500);
      script_version("1.18");
      script_cvs_date("Date: 2019/08/02 13:32:41");
    
      script_cve_id("CVE-2004-0397");
      script_xref(name:"GLSA", value:"200405-14");
    
      script_name(english:"GLSA-200405-14 : Buffer overflow in Subversion");
      script_summary(english:"Checks for updated package(s) in /var/db/pkg");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Gentoo host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is affected by the vulnerability described in GLSA-200405-14
    (Buffer overflow in Subversion)
    
        All releases of Subversion prior to 1.0.3 have a vulnerability in the
        date-parsing code. This vulnerability may allow denial of service or
        arbitrary code execution as the Subversion user. Both the client and
        server are vulnerable, and write access is NOT required to the server's
        repository.
      
    Impact :
    
        All servers and clients are vulnerable. Specifically, clients that
        allow other users to write to administrative files in a working copy
        may be exploited. Additionally all servers (whether they are httpd/DAV
        or svnserve) are vulnerable. Write access to the server is not
        required; public read-only Subversion servers are also exploitable.
      
    Workaround :
    
        There is no known workaround at this time. All users are encouraged to
        upgrade to the latest available version."
      );
      # http://subversion.tigris.org/servlets/ReadMsg?list=announce&msgNo=125
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?1853132a"
      );
      # http://security.e-matters.de/advisories/082004.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?8a28c1fb"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security.gentoo.org/glsa/200405-14"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "All Subversion users should upgrade to the latest stable version:
        # emerge sync
        # emerge -pv '>=dev-util/subversion-1.0.3'
        # emerge '>=dev-util/subversion-1.0.3'"
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Subversion Date Svnserve');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:subversion");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2004/05/20");
      script_set_attribute(attribute:"plugin_publication_date", value:"2004/08/30");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2004-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Gentoo Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("qpkg.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
    if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (qpkg_check(package:"dev-util/subversion", unaffected:make_list("ge 1.0.3"), vulnerable:make_list("le 1.0.2"))) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = qpkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "dev-util/subversion");
    }
    
  • NASL familyMisc.
    NASL idSUBVERSION_1_0_4.NASL
    descriptionThe remote host is vulnerable to a remote stack-based overflow. An attacker, exploiting this hole, would be given full access to the target machine. Versions of Subversion less than 1.0.3 are vulnerable to this attack. This vulnerability was discovered by Stefan Esser and posted to public mailing lists.
    last seen2020-06-01
    modified2020-06-02
    plugin id12261
    published2004-06-08
    reporterThis script is Copyright (C) 2004-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/12261
    titleSubversion < 1.0.3 apr_time_t data Conversion Remote Overflow
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include( 'compat.inc' );
    
    if(description)
    {
      script_id(12261);
      script_version ("1.19");
      script_cve_id("CVE-2004-0397");
      script_bugtraq_id(10386);
    
      script_name(english:"Subversion < 1.0.3 apr_time_t data Conversion Remote Overflow");
      script_summary(english:"Subversion remote Buffer Overflow");
    
      script_set_attribute(
        attribute:'synopsis',
        value:'The remote service is vulnerable to a buffer overflow.'
      );
    
      script_set_attribute(
        attribute:'description',
        value:'The remote host is vulnerable to a remote stack-based
    overflow.  An attacker, exploiting this hole, would be
    given full access to the target machine.  Versions of
    Subversion less than 1.0.3 are vulnerable to this attack.
    This vulnerability was discovered by Stefan Esser and posted
    to public mailing lists.'
      );
    
      script_set_attribute(
        attribute:'solution',
        value:'Upgrade to version 1.0.3 or higher'
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Subversion Date Svnserve');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
    
      script_set_attribute(
        attribute:'see_also',
        value:'https://seclists.org/bugtraq/2004/May/216'
      );
    
      script_set_attribute(
        attribute:'see_also',
        value:'http://subversion.tigris.org/svn-sscanf-advisory.txt'
      );
    
     script_set_attribute(attribute:"plugin_publication_date", value: "2004/06/08");
     script_set_attribute(attribute:"vuln_publication_date", value: "2004/05/19");
     script_cvs_date("Date: 2018/11/15 20:50:24");
      script_set_attribute(attribute:"plugin_type", value:"remote");
      script_end_attributes();
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2004-2018 Tenable Network Security, Inc.");
      script_family(english:"Misc.");
      script_dependencie("subversion_detection.nasl");
      script_require_ports("Services/subversion");
      exit(0);
    }
    
    
    
    # start check
    # mostly horked from MetaSploit Framework subversion overflow check
    
    port = get_kb_item("Services/subversion");
    if ( ! port ) port = 3690;
    
    if (! get_tcp_port_state(port))
    	exit(0);
    
    dat = string("( 2 ( edit-pipeline ) 24:svn://host/svn/nessusr0x ) ");
    
    soc = open_sock_tcp(port);
    if (!soc)
            exit(0);
    
    r = recv_line(socket:soc, length:1024);
    
    if (! r)
    	exit(0);
    
    send(socket:soc, data:dat);
    r = recv_line(socket:soc, length:256);
    
    if (! r)
    	exit(0);
    
    #display(r);
    
    if (egrep(string:r, pattern:".*subversion-1\.0\.[0-2][^0-9].*"))
    {
    	security_hole(port);
    }
    
    close(soc);
    exit(0);
    
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_SUBVERSION_102_1.NASL
    descriptionThe following package needs to be updated: subversion
    last seen2016-09-26
    modified2011-10-03
    plugin id12618
    published2004-07-06
    reporterTenable
    sourcehttps://www.tenable.com/plugins/index.php?view=single&id=12618
    titleFreeBSD : subversion date parsing vulnerability (187)
    code
    #%NASL_MIN_LEVEL 999999
    
    # @DEPRECATED@
    #
    # This script has been deprecated by freebsd_pkg_5d36ef32a9cf11d89c6d0020ed76ef5a.nasl.
    #
    # Disabled on 2011/10/02.
    #
    
    #
    # (C) Tenable Network Security, Inc.
    #
    # This script contains information extracted from VuXML :
    #
    # Copyright 2003-2006 Jacques Vidrine and contributors
    #
    # Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
    # HTML, PDF, PostScript, RTF and so forth) with or without modification,
    # are permitted provided that the following conditions are met:
    # 1. Redistributions of source code (VuXML) must retain the above
    #   copyright notice, this list of conditions and the following
    #   disclaimer as the first lines of this file unmodified.
    # 2. Redistributions in compiled form (transformed to other DTDs,
    #   published online in any format, converted to PDF, PostScript,
    #   RTF and other formats) must reproduce the above copyright
    #   notice, this list of conditions and the following disclaimer
    #   in the documentation and/or other materials provided with the
    #   distribution.
    #
    # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
    # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
    # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
    # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
    # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
    # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
    # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
    # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
    # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
    # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
    # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
    #
    #
    #
    
    include('compat.inc');
    
    if ( description )
    {
     script_id(12618);
     script_version("1.12");
     script_cve_id("CVE-2004-0397");
    
     script_name(english:"FreeBSD : subversion date parsing vulnerability (187)");
    
    script_set_attribute(attribute:'synopsis', value: 'The remote host is missing a security update');
    script_set_attribute(attribute:'description', value:'The following package needs to be updated: subversion');
     script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
     script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
     script_set_attribute(attribute:"exploit_available", value:"true");
     script_set_attribute(attribute:"metasploit_name", value:'Subversion Date Svnserve');
     script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
     script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
     script_set_attribute(attribute:"canvas_package", value:'CANVAS');
    script_set_attribute(attribute:'solution', value: 'Update the package on the remote host');
    script_set_attribute(attribute: 'see_also', value: 'http://secunia.com/advisories/30994
    http://secunia.com/advisories/9096
    http://security.e-matters.de/advisories/082004.html
    http://www.freedesktop.org/wiki/Software/dbus
    http://www.frsirt.com/english/advisories/2006/0554
    http://www.mozilla.org/security/announce/2008/mfsa2008-60.html
    http://www.mozilla.org/security/announce/2008/mfsa2008-61.html
    http://www.securiteam.com/unixfocus/5CP0N0UAAA.html
    http://www.ssh.com/company/newsroom/article/715/
    http://x82.inetcop.org/h0me/adv1sor1es/INCSA.2003-0x82-018-GNATS-bt.txt');
    script_set_attribute(attribute:'see_also', value: 'http://www.FreeBSD.org/ports/portaudit/5d36ef32-a9cf-11d8-9c6d-0020ed76ef5a.html');
    
     script_set_attribute(attribute:"plugin_publication_date", value: "2004/07/06");
     script_cvs_date("Date: 2018/07/20  0:18:52");
     script_end_attributes();
     script_summary(english:"Check for subversion");
     script_category(ACT_GATHER_INFO);
     script_copyright(english:"This script is Copyright (C) 2004-2018 Tenable Network Security, Inc.");
     family["english"] = "FreeBSD Local Security Checks";
     script_family(english:family["english"]);
     script_dependencies("ssh_get_info.nasl");
     script_require_keys("Host/FreeBSD/pkg_info");
     exit(0);
    }
    
    # Deprecated.
    exit(0, "This plugin has been deprecated. Refer to plugin #36673 (freebsd_pkg_5d36ef32a9cf11d89c6d0020ed76ef5a.nasl) instead.");
    
    global_var cvss_score;
    cvss_score=7;
    include('freebsd_package.inc');
    
    
    pkg_test(pkg:"subversion<1.0.2_1");
    
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_5D36EF32A9CF11D89C6D0020ED76EF5A.NASL
    descriptionStefan Esser reports : Subversion versions up to 1.0.2 are vulnerable to a date parsing vulnerability which can be abused to allow remote code execution on Subversion servers and therefore could lead to a repository compromise. NOTE: This vulnerability is similar to the date parsing issue that affected neon. However, it is a different and distinct bug.
    last seen2020-06-01
    modified2020-06-02
    plugin id36673
    published2009-04-23
    reporterThis script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/36673
    titleFreeBSD : subversion date parsing vulnerability (5d36ef32-a9cf-11d8-9c6d-0020ed76ef5a)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the FreeBSD VuXML database :
    #
    # Copyright 2003-2018 Jacques Vidrine and contributors
    #
    # Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
    # HTML, PDF, PostScript, RTF and so forth) with or without modification,
    # are permitted provided that the following conditions are met:
    # 1. Redistributions of source code (VuXML) must retain the above
    #    copyright notice, this list of conditions and the following
    #    disclaimer as the first lines of this file unmodified.
    # 2. Redistributions in compiled form (transformed to other DTDs,
    #    published online in any format, converted to PDF, PostScript,
    #    RTF and other formats) must reproduce the above copyright
    #    notice, this list of conditions and the following disclaimer
    #    in the documentation and/or other materials provided with the
    #    distribution.
    # 
    # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
    # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
    # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
    # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
    # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
    # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
    # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
    # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
    # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
    # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
    # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(36673);
      script_version("1.13");
      script_cvs_date("Date: 2019/08/02 13:32:36");
    
      script_cve_id("CVE-2004-0397");
    
      script_name(english:"FreeBSD : subversion date parsing vulnerability (5d36ef32-a9cf-11d8-9c6d-0020ed76ef5a)");
      script_summary(english:"Checks for updated package in pkg_info output");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote FreeBSD host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Stefan Esser reports :
    
    Subversion versions up to 1.0.2 are vulnerable to a date parsing
    vulnerability which can be abused to allow remote code execution on
    Subversion servers and therefore could lead to a repository
    compromise.
    
    NOTE: This vulnerability is similar to the date parsing issue that
    affected neon. However, it is a different and distinct bug."
      );
      # http://security.e-matters.de/advisories/082004.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?8a28c1fb"
      );
      # https://vuxml.freebsd.org/freebsd/5d36ef32-a9cf-11d8-9c6d-0020ed76ef5a.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?c36501c0"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected package.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Subversion Date Svnserve');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:subversion");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2004/05/19");
      script_set_attribute(attribute:"patch_publication_date", value:"2004/05/19");
      script_set_attribute(attribute:"plugin_publication_date", value:"2009/04/23");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"FreeBSD Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("freebsd_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD");
    if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (pkg_test(save_report:TRUE, pkg:"subversion<1.0.2_1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/82288/svnserve_date.rb.txt
idPACKETSTORM:82288
last seen2016-12-05
published2009-10-28
reporterspoonm
sourcehttps://packetstormsecurity.com/files/82288/Subversion-Date-Overflow.html
titleSubversion Date Overflow