Bug 581448 – <dev-vcs/subversion-{1.8.16,1.9.4}: Multiple vulnerabilities (CVE-2016-{2167,2168})

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Lars Wendler (Polynomial-C) (RETIRED) 2016-04-28 14:03:44 UTC]

* CVE-2016-2167
    svnserve/sasl may authenticate users using the wrong realm
  * CVE-2016-2168
    mod_authz_svn: DoS in MOVE/COPY authorization check

I have no further information yet. Bot issues are fixed with subversion-1.8.16 and subversion-1.9.4 which I already have the ebuilds/source-tarballs avaibale yet.

[Comment 1 Lars Wendler (Polynomial-C) (RETIRED) 2016-04-28 19:46:11 UTC]

Upstream finally announced the release:

http://mail-archives.apache.org/mod_mbox/subversion-announce/201604.mbox/[e-mail]%3E

Please unrestrict this bug.

[Comment 2 Lars Wendler (Polynomial-C) (RETIRED) 2016-04-28 19:55:19 UTC]

commit a008b507559a8a06e3ba06fb8e9b18ca54c1d3d5
Author: Lars Wendler <[e-mail]>
Date:   Thu Apr 28 21:52:29 2016

    dev-vcs/subversion: Security bump to versions 1.8.16 and 1.9.4 (bug #581448).

    Package-Manager: portage-2.2.28
    Signed-off-by: Lars Wendler <[e-mail]>


Arches please test and mark stable =dev-vcs/subversion-1.8.16 with target KEYWORDS:

alpha amd64 arm ~arm64 hppa ia64 ~mips ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~amd64-fbsd ~x86-fbsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris

[Comment 3 Kristian Fiskerstrand (RETIRED) 2016-04-28 20:00:04 UTC]

Publicly released, lifting restriction

[Comment 4 Agostino Sarubbo 2016-04-29 11:38:56 UTC]

Arches, please test and mark stable:
=dev-vcs/subversion-1.8.16
Target keywords : "alpha amd64 arm hppa ia64 ppc ppc64 sparc x86"

[Comment 5 Agostino Sarubbo 2016-04-29 13:01:14 UTC]

amd64 stable

[Comment 6 Jeroen Roovers (RETIRED) 2016-05-05 08:58:03 UTC]

Stable for HPPA PPC64.

[Comment 7 Markus Meier 2016-05-12 17:18:29 UTC]

arm stable

[Comment 8 Tobias Klausmann (RETIRED) 2016-05-20 19:14:39 UTC]

Stable on alpha.

[Comment 9 Agostino Sarubbo 2016-06-27 09:02:37 UTC]

x86 stable

[Comment 10 GLSAMaker/CVETool Bot 2016-06-28 03:27:04 UTC]

CVE-2016-2168 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2168):
  The req_check_access function in the mod_authz_svn module in the httpd
  server in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4 allows
  remote authenticated users to cause a denial of service (NULL pointer
  dereference and crash) via a crafted header in a (1) MOVE or (2) COPY
  request, involving an authorization check.

CVE-2016-2167 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2167):
  The canonicalize_username function in svnserve/cyrus_auth.c in Apache
  Subversion before 1.8.16 and 1.9.x before 1.9.4, when Cyrus SASL
  authentication is used, allows remote attackers to authenticate and bypass
  intended access restrictions via a realm string that is a prefix of an
  expected repository realm string.

[Comment 11 Aaron Bauman (RETIRED) 2016-06-28 03:31:19 UTC]

(In reply to Lars Wendler (Polynomial-C) from comment #2)
> commit a008b507559a8a06e3ba06fb8e9b18ca54c1d3d5
> Author: Lars Wendler <[e-mail]>
> Date:   Thu Apr 28 21:52:29 2016
> 
>     dev-vcs/subversion: Security bump to versions 1.8.16 and 1.9.4 (bug
> #581448).
> 
>     Package-Manager: portage-2.2.28
>     Signed-off-by: Lars Wendler <[e-mail]>
> 
> 
> Arches please test and mark stable =dev-vcs/subversion-1.8.16 with target
> KEYWORDS:
> 
> alpha amd64 arm ~arm64 hppa ia64 ~mips ppc ppc64 ~s390 ~sh sparc x86
> ~ppc-aix ~amd64-fbsd ~x86-fbsd ~x86-freebsd ~hppa-hpux ~ia64-hpux
> ~x86-interix ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos
> ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris
> ~x86-solaris

Any reason not to stabilize 1.9.4?  Upstream supports 1.9.x branch for security related bug fixes plus the latest 1.8.x branch.  If so, we can call for stabilization again here.

Added to existing GLSA.

[Comment 12 Agostino Sarubbo 2016-07-08 08:19:07 UTC]

ppc stable

[Comment 13 Agostino Sarubbo 2016-07-08 08:43:28 UTC]

sparc stable

[Comment 14 Agostino Sarubbo 2016-07-08 13:29:50 UTC]

ia64 stable.

Maintainer(s), please cleanup.

[Comment 15 Aaron Bauman (RETIRED) 2016-07-18 06:28:41 UTC]

Adding maintainers to CC.  Please clean:

=dev-vcs/subversion-{1.8.14, 1.9.3}

[Comment 16 GLSAMaker/CVETool Bot 2016-10-11 12:47:47 UTC]

This issue was resolved and addressed in
 GLSA 201610-05 at https://security.gentoo.org/glsa/201610-05
by GLSA coordinator Aaron Bauman (b-man).