glsa-201709-09.xml


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsa id="201709-09">
  <title>Subversion: Arbitrary code execution</title>
  <synopsis>A command injection vulnerability in Subversion may allow remote
    attackers to execute arbitrary code.
  </synopsis>
  <product type="ebuild">subversion</product>
  <announced>2017-09-17</announced>
  <revised count="1">2017-09-17</revised>
  <bug>627480</bug>
  <access>remote</access>
  <affected>
    <package name="dev-vcs/subversion" auto="yes" arch="*">
      <unaffected range="ge">1.9.7</unaffected>
      <unaffected range="rgt">1.8.18</unaffected>
      <vulnerable range="lt">1.9.7</vulnerable>
    </package>
  </affected>
  <background>
    <p>Subversion is a version control system intended to eventually replace
      CVS. Like CVS, it has an optional client-server architecture (where the
      server can be an Apache server running mod_svn, or an ssh program as in
      CVS’s :ext: method). In addition to supporting the features found in
      CVS, Subversion also provides support for moving and copying files and
      directories.
    </p>
  </background>
  <description>
    <p>Specially crafted ‘ssh://...’ URLs may allow the owner of the
      repository to execute arbitrary commands on client’s machine if those
      commands are already installed on the client’s system. This is
      especially dangerous when the third-party repository has one or more
      submodules with specially crafted ‘ssh://...’ URLs. Each time the
      repository is recursively cloned or submodules are updated the payload
      will be triggered.
    </p>
  </description>
  <impact type="normal">
    <p>A remote attacker, by enticing a user to clone a specially crafted
      repository, could possibly execute arbitrary code with the privileges of
      the process.
    </p>
  </impact>
  <workaround>
    <p>There are several alternative ways to fix this vulnerability. Please
      refer to Subversion Team Announce for more details.
    </p>
  </workaround>
  <resolution>
    <p>All Subversion 1.9.x users should upgrade to the latest version:</p>
    
    <code>
      # emerge --sync
      # emerge --ask --oneshot --verbose "&gt;=dev-vcs/subversion-1.9.7"
    </code>
    
    <p>All Subversion 1.8.x users should upgrade to the latest version:</p>
    
    <code>
      # emerge --sync
      # emerge --ask --oneshot --verbose "&gt;=dev-vcs/subversion-1.8.18"
    </code>
  </resolution>
  <references>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-9800">
      CVE-2017-9800
    </uri>
    <uri link="https://subversion.apache.org/security/CVE-2017-9800-advisory.txt">
      Subversion Team Announce
    </uri>
  </references>
  <metadata tag="requester" timestamp="2017-09-01T12:55:21Z">b-man</metadata>
  <metadata tag="submitter" timestamp="2017-09-17T15:50:43Z">chrisadr</metadata>
</glsa>