Cloudanix VulnDB

CVE-2013-1884

None

CVSS

—

EPSS

50.5%

Published

May 2, 2013

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Attend

A bug in older Subversion servers lets anyone on the network send a specially crafted request that crashes the server and stops people from accessing code repositories.

Exploit Available
Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Network Service
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Remote unauthenticated attacker can trigger a segmentation fault in mod_dav_svn by sending a log REPORT request containing an invalid limit value, causing access to an uninitialized variable and process crash.

Why it matters to the business

Subversion servers become unavailable, halting developer access to version-controlled code and disrupting build pipelines and release processes until the service is restarted.

How an attack unfolds

An attacker locates an exposed Subversion server running mod_dav_svn, crafts a REPORT request for the log operation that supplies an out-of-range limit parameter, and sends it over HTTP; the server dereferences uninitialized memory and terminates.

How to fix it

Upgrade Subversion to a release newer than 1.7.8 that contains the fix for the uninitialized variable handling in mod_dav_svn, or disable the DAV module if Subversion web access is not required.

How to confirm the fix worked

Verify the installed Subversion version is newer than 1.7.8; attempt to reproduce the crash with a test REPORT request containing an invalid limit and confirm the server no longer terminates.

Typical attack path

  1. Scan for publicly reachable Subversion servers exposing /svn/ paths over HTTP
  2. Issue a crafted log REPORT request containing an invalid limit value
  3. Observe server crash and restart behavior to confirm impact
  4. Repeat requests to maintain denial of service

How to detect it

Review Apache access and error logs for REPORT requests to log paths that contain unusually large or negative limit parameters; correlate with segmentation fault entries mentioning mod_dav_svn or svn processes.

  • REPORT.*limit=-
  • mod_dav_svn.*segmentation fault
  • svn.*uninitialized variable

What your security team should do

  • Immediately upgrade all Subversion 1.7.x installations to a patched release
  • Restrict network exposure of mod_dav_svn to trusted clients only
  • Monitor Apache error logs for segmentation fault entries related to mod_dav_svn
  • Consider migrating to a maintained Subversion release branch with ongoing security updates

The record

The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (segmentation fault and crash) via a log REPORT request with an invalid limit, which triggers an access of an uninitialized variable.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 subversion 0 1.7.9-1
Debian:12 subversion 0 1.7.9-1
Debian:13 subversion 0 1.7.9-1
openSUSE:Tumbleweed subversion 0 1.9.5-1.1

Related vulnerabilities