CVE-2014-3580

What it actually does

Null pointer dereference in mod_dav_svn triggered by a REPORT request referencing a non-existent resource, resulting in immediate process termination.

Why it matters to the business

Subversion servers become unavailable until manually restarted, interrupting source code access and build pipelines for organizations still running unpatched 1.x releases.

How an attack unfolds

An unauthenticated remote attacker crafts a REPORT request that targets a path or revision the server does not recognize; the mod_dav_svn handler dereferences a null pointer while processing the request and the httpd worker crashes.

How to fix it

Upgrade Apache Subversion to 1.7.19 or 1.8.11 (or later) and restart the Apache HTTPD service. Where upgrades are not immediately possible, restrict REPORT methods or place the server behind an authenticating proxy.

How to confirm the fix worked

Confirm the installed Subversion version is at least 1.7.19 or 1.8.11; attempt the same REPORT request in a test environment and verify the server no longer terminates.

Typical attack path

1. Locate an Apache HTTPD instance exposing Subversion repositories via mod_dav_svn
2. Issue a crafted REPORT request for a non-existent resource or revision
3. Observe server crash and repeated restarts or service degradation

How to detect it

Review Apache error logs for segmentation faults or abort signals originating from mod_dav_svn worker processes immediately following REPORT requests; correlate with access logs showing requests to non-existent paths or revisions.

• mod_dav_svn.*null pointer
• segfault.*dav_svn
• REPORT.*404.*mod_dav_svn

What your security team should do

• Prioritize upgrade of all internet-facing Subversion servers to the fixed releases
• Add mod_dav_svn version checks to vulnerability scanning and asset inventory
• Monitor httpd error logs for segmentation faults or null dereference messages tied to mod_dav_svn