CVE-2013-1847

What it actually does

NULL pointer dereference in mod_dav_svn triggered by an anonymous LOCK request against a nonexistent URL, resulting in immediate process crash.

Why it matters to the business

Unexpected downtime for Subversion repositories accessed over HTTP, interrupting developer workflows and source control operations until the service is restarted.

How an attack unfolds

An unauthenticated attacker issues a WebDAV LOCK request targeting a URL that does not exist on the server; the module dereferences a null pointer while handling the request and terminates the Apache worker process.

How to fix it

Upgrade Apache Subversion to a version later than 1.7.8 or 1.6.20 that resolves the NULL dereference; alternatively restrict anonymous access or disable mod_dav_svn if WebDAV locking is unnecessary.

How to confirm the fix worked

Confirm the installed Subversion version is outside the affected range; attempt a LOCK request against a nonexistent URL and verify the server no longer crashes.

Typical attack path

1. Discover a Subversion repository exposed via mod_dav_svn
2. Send an anonymous HTTP LOCK request to a nonexistent path under the repository
3. Trigger the NULL dereference and observe service crash or restart

How to detect it

Review Apache access logs for anonymous LOCK requests returning 404 status codes immediately before worker process crashes or restarts; correlate with mod_dav_svn error logs showing NULL pointer dereference.

What your security team should do

• Upgrade Subversion installations to a fixed release as soon as possible
• Disable anonymous LOCK operations or require authentication on all DAV-accessible paths
• Monitor for repeated LOCK requests returning 404 responses followed by worker crashes