CVE-2004-0749

The mod_authz_svn module in Subversion 1.0.7 and earlier does not properly restrict access to all metadata on unreadable paths, which could allow remote attackers to gain sensitive information via (1) svn log -v, (2) svn propget, or (3) svn blame, and other commands that follow renames.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://fedoranews.org/updates/FEDORA-2004-318.shtml
http://subversion.tigris.org/security/CAN-2004-0749-advisory.txt	Patch Vendor Advisory
http://www.gentoo.org/security/en/glsa/glsa-200409-35.xml	Patch Vendor Advisory
http://www.securityfocus.com/bid/11243	Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/17472

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:subversion:subversion:1.0:::::::*
	cpe:2.3:a:subversion:subversion:1.0.1:::::::*
	cpe:2.3:a:subversion:subversion:1.0.2:::::::*
	cpe:2.3:a:subversion:subversion:1.0.3:::::::*
	cpe:2.3:a:subversion:subversion:1.0.4:::::::*
	cpe:2.3:a:subversion:subversion:1.0.5:::::::*
	cpe:2.3:a:subversion:subversion:1.0.6:::::::*
	cpe:2.3:a:subversion:subversion:1.0.7:::::::*
	cpe:2.3:a:subversion:subversion:1.1.0_rc1:::::::*
	cpe:2.3:a:subversion:subversion:1.1.0_rc2:::::::*
	cpe:2.3:a:subversion:subversion:1.1.0_rc3:::::::*

Configuration 2 (hide)

OR	cpe:2.3:o:gentoo:linux:0.5:::::::*
	cpe:2.3:o:gentoo:linux:0.7:::::::*
	cpe:2.3:o:gentoo:linux:1.1a:::::::*
	cpe:2.3:o:gentoo:linux:1.2:::::::*
	cpe:2.3:o:gentoo:linux:1.4:::::::*
	cpe:2.3:o:gentoo:linux:1.4:rc1::::::
	cpe:2.3:o:gentoo:linux:1.4:rc2::::::
	cpe:2.3:o:gentoo:linux:1.4:rc3::::::

History

No history.

Information

Published : 2004-12-23 05:00

Updated : 2017-07-11 01:30

NVD link : CVE-2004-0749

Mitre link : CVE-2004-0749

CVE.ORG link : CVE-2004-0749

JSON object : View

Products Affected

subversion

subversion

gentoo

linux

CWE

NVD-CWE-Other

{"id": "CVE-2004-0749", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2004-12-23T05:00:00.000", "references": [{"url": "http://fedoranews.org/updates/FEDORA-2004-318.shtml", "source": "cve@mitre.org"}, {"url": "http://subversion.tigris.org/security/CAN-2004-0749-advisory.txt", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.gentoo.org/security/en/glsa/glsa-200409-35.xml", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/11243", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17472", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "The mod_authz_svn module in Subversion 1.0.7 and earlier does not properly restrict access to all metadata on unreadable paths, which could allow remote attackers to gain sensitive information via (1) svn log -v, (2) svn propget, or (3) svn blame, and other commands that follow renames."}, {"lang": "es", "value": "El m\u00f3dulo mod_authz_svn en Subversion 1.0.7 y anteriores no restringe adecuadamente el acceso a todos los metadatos en rutas ilegibles, lo que podr\u00eda permitir a atacantes remotos ganar informaci\u00f3n sensible mediante (1) svn log -v, (2) svn propget, o (3) svn blame, y otras \u00f3rdenes que siguen cambios de de nombre."}], "lastModified": "2017-07-11T01:30:26.387", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:subversion:subversion:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4F10E314-3897-4A63-AE40-F4E34C3F0BFA"}, {"criteria": "cpe:2.3:a:subversion:subversion:1.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "47B95A69-2535-4844-B819-082D4349708C"}, {"criteria": "cpe:2.3:a:subversion:subversion:1.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "930953B4-E972-48FB-913B-169E91F93FD6"}, {"criteria": "cpe:2.3:a:subversion:subversion:1.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6B41D875-F515-4A3F-9AA5-79BD09F74C30"}, {"criteria": "cpe:2.3:a:subversion:subversion:1.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3A8CCC20-8986-4028-B125-66F371A4A1D1"}, {"criteria": "cpe:2.3:a:subversion:subversion:1.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6E07F13C-A6FC-49E8-B10E-E4FC1F182DA5"}, {"criteria": "cpe:2.3:a:subversion:subversion:1.0.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "04AB9C70-10CB-460B-91AD-1D79C9153194"}, {"criteria": "cpe:2.3:a:subversion:subversion:1.0.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E1E718DB-2A79-4277-BA15-6E6A904E483A"}, {"criteria": "cpe:2.3:a:subversion:subversion:1.1.0_rc1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "286B7EBD-D663-440C-859B-1E0EE839AEB9"}, {"criteria": "cpe:2.3:a:subversion:subversion:1.1.0_rc2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "408EC889-4D8B-49FC-9281-AC85559BB774"}, {"criteria": "cpe:2.3:a:subversion:subversion:1.1.0_rc3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F1E2A83E-A244-4F1E-85E9-6EA075D32C5B"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:gentoo:linux:0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "980553F2-8662-47CF-95F0-645141746AEA"}, {"criteria": "cpe:2.3:o:gentoo:linux:0.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40EBF1CD-B392-4262-8F06-2C784ADAF0F0"}, {"criteria": "cpe:2.3:o:gentoo:linux:1.1a:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9C00F84A-FCD4-4935-B7DE-ECBA6AE9B074"}, {"criteria": "cpe:2.3:o:gentoo:linux:1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "960DC6C2-B285-41D4-96F7-ED97F8BD5482"}, {"criteria": "cpe:2.3:o:gentoo:linux:1.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "65ED9D8C-604D-4B0B-A192-C0DA4D2E9AEB"}, {"criteria": "cpe:2.3:o:gentoo:linux:1.4:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D1FD0EB4-E744-4465-AFEE-A3C807C9C993"}, {"criteria": "cpe:2.3:o:gentoo:linux:1.4:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D866A7D-F0B9-4EA3-93C6-1E7C2C2A861F"}, {"criteria": "cpe:2.3:o:gentoo:linux:1.4:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "57772E3B-893C-408A-AA3B-78C972ED4D5E"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}