Säkerhetsbulletin från Debian

DSA-2118-1 subversion -- logikfel

Rapporterat den:

2010-10-08

Berörda paket:

subversion

Sårbara:

Referenser i säkerhetsdatabaser:

I Mitres CVE-förteckning: CVE-2010-3315.

Ytterligare information:

Kamesh Jayachandran och C. Michael Pilat upptäckte att modulen mod_dav_svn i Subversion, ett versionshanteringssystem, inte applicerar åtkomstregler som är omfångsbegränsade på ett korrekt sätt till namngivna arkiv. Om alternativet SVNPathAuthz är satt till short_circuit kan detta tillåta en angripare utan rättigheter att kringgå de tänkta åtkomstrestriktionerna och få tillgång till eller ändra arkivinnehåll.

Som en temporär rättelse är det också möjligt att sätta SVNPathAuthz till on, men var uppmärksam på at detta kan resultera i en prestandaförsämring för stora arkiv.

För den stabila utgåvan (Lenny) har detta problem rättats i version 1.5.1dfsg1-5.

För uttestningsutgåvan (Squeeze) har detta problem rättats i version 1.6.12dfsg-2.

För den instabila utgåvan (Sid) har detta problem rättats i version 1.6.12dfsg-2.

Vi rekommenderar att ni uppgraderar era subversion-paket.

Rättat i:

Debian GNU/Linux 5.0 (lenny)

Källkod:: http://security.debian.org/pool/updates/main/s/subversion/subversion_1.5.1dfsg1-5.diff.gz; http://security.debian.org/pool/updates/main/s/subversion/subversion_1.5.1dfsg1-5.dsc; http://security.debian.org/pool/updates/main/s/subversion/subversion_1.5.1dfsg1.orig.tar.gz
Arkitekturoberoende komponent:: http://security.debian.org/pool/updates/main/s/subversion/libsvn-doc_1.5.1dfsg1-5_all.deb; http://security.debian.org/pool/updates/main/s/subversion/subversion-tools_1.5.1dfsg1-5_all.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn-ruby_1.5.1dfsg1-5_all.deb
Alpha:: http://security.debian.org/pool/updates/main/s/subversion/libsvn-ruby1.8_1.5.1dfsg1-5_alpha.deb; http://security.debian.org/pool/updates/main/s/subversion/subversion_1.5.1dfsg1-5_alpha.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn1_1.5.1dfsg1-5_alpha.deb; http://security.debian.org/pool/updates/main/s/subversion/libapache2-svn_1.5.1dfsg1-5_alpha.deb; http://security.debian.org/pool/updates/main/s/subversion/python-subversion_1.5.1dfsg1-5_alpha.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn-perl_1.5.1dfsg1-5_alpha.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn-dev_1.5.1dfsg1-5_alpha.deb
AMD64:: http://security.debian.org/pool/updates/main/s/subversion/subversion_1.5.1dfsg1-5_amd64.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn-java_1.5.1dfsg1-5_amd64.deb; http://security.debian.org/pool/updates/main/s/subversion/libapache2-svn_1.5.1dfsg1-5_amd64.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn-dev_1.5.1dfsg1-5_amd64.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn1_1.5.1dfsg1-5_amd64.deb; http://security.debian.org/pool/updates/main/s/subversion/python-subversion_1.5.1dfsg1-5_amd64.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn-perl_1.5.1dfsg1-5_amd64.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn-ruby1.8_1.5.1dfsg1-5_amd64.deb
ARM EABI:: http://security.debian.org/pool/updates/main/s/subversion/libsvn-dev_1.5.1dfsg1-5_armel.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn1_1.5.1dfsg1-5_armel.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn-perl_1.5.1dfsg1-5_armel.deb; http://security.debian.org/pool/updates/main/s/subversion/subversion_1.5.1dfsg1-5_armel.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn-java_1.5.1dfsg1-5_armel.deb; http://security.debian.org/pool/updates/main/s/subversion/python-subversion_1.5.1dfsg1-5_armel.deb; http://security.debian.org/pool/updates/main/s/subversion/libapache2-svn_1.5.1dfsg1-5_armel.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn-ruby1.8_1.5.1dfsg1-5_armel.deb
HP Precision:: http://security.debian.org/pool/updates/main/s/subversion/libsvn-perl_1.5.1dfsg1-5_hppa.deb; http://security.debian.org/pool/updates/main/s/subversion/python-subversion_1.5.1dfsg1-5_hppa.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn1_1.5.1dfsg1-5_hppa.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn-dev_1.5.1dfsg1-5_hppa.deb; http://security.debian.org/pool/updates/main/s/subversion/libapache2-svn_1.5.1dfsg1-5_hppa.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn-ruby1.8_1.5.1dfsg1-5_hppa.deb; http://security.debian.org/pool/updates/main/s/subversion/subversion_1.5.1dfsg1-5_hppa.deb
Intel IA-32:: http://security.debian.org/pool/updates/main/s/subversion/libsvn-dev_1.5.1dfsg1-5_i386.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn-java_1.5.1dfsg1-5_i386.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn-perl_1.5.1dfsg1-5_i386.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn1_1.5.1dfsg1-5_i386.deb; http://security.debian.org/pool/updates/main/s/subversion/subversion_1.5.1dfsg1-5_i386.deb; http://security.debian.org/pool/updates/main/s/subversion/libapache2-svn_1.5.1dfsg1-5_i386.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn-ruby1.8_1.5.1dfsg1-5_i386.deb; http://security.debian.org/pool/updates/main/s/subversion/python-subversion_1.5.1dfsg1-5_i386.deb
Intel IA-64:: http://security.debian.org/pool/updates/main/s/subversion/libsvn-perl_1.5.1dfsg1-5_ia64.deb; http://security.debian.org/pool/updates/main/s/subversion/python-subversion_1.5.1dfsg1-5_ia64.deb; http://security.debian.org/pool/updates/main/s/subversion/libapache2-svn_1.5.1dfsg1-5_ia64.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn-dev_1.5.1dfsg1-5_ia64.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn-ruby1.8_1.5.1dfsg1-5_ia64.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn1_1.5.1dfsg1-5_ia64.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn-java_1.5.1dfsg1-5_ia64.deb; http://security.debian.org/pool/updates/main/s/subversion/subversion_1.5.1dfsg1-5_ia64.deb
Big-endian MIPS:: http://security.debian.org/pool/updates/main/s/subversion/python-subversion_1.5.1dfsg1-5_mips.deb; http://security.debian.org/pool/updates/main/s/subversion/libapache2-svn_1.5.1dfsg1-5_mips.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn-dev_1.5.1dfsg1-5_mips.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn1_1.5.1dfsg1-5_mips.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn-perl_1.5.1dfsg1-5_mips.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn-ruby1.8_1.5.1dfsg1-5_mips.deb; http://security.debian.org/pool/updates/main/s/subversion/subversion_1.5.1dfsg1-5_mips.deb
Little-endian MIPS:: http://security.debian.org/pool/updates/main/s/subversion/libsvn1_1.5.1dfsg1-5_mipsel.deb; http://security.debian.org/pool/updates/main/s/subversion/libapache2-svn_1.5.1dfsg1-5_mipsel.deb; http://security.debian.org/pool/updates/main/s/subversion/python-subversion_1.5.1dfsg1-5_mipsel.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn-ruby1.8_1.5.1dfsg1-5_mipsel.deb; http://security.debian.org/pool/updates/main/s/subversion/subversion_1.5.1dfsg1-5_mipsel.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn-perl_1.5.1dfsg1-5_mipsel.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn-dev_1.5.1dfsg1-5_mipsel.deb
PowerPC:: http://security.debian.org/pool/updates/main/s/subversion/subversion_1.5.1dfsg1-5_powerpc.deb; http://security.debian.org/pool/updates/main/s/subversion/python-subversion_1.5.1dfsg1-5_powerpc.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn-java_1.5.1dfsg1-5_powerpc.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn-dev_1.5.1dfsg1-5_powerpc.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn1_1.5.1dfsg1-5_powerpc.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn-ruby1.8_1.5.1dfsg1-5_powerpc.deb; http://security.debian.org/pool/updates/main/s/subversion/libapache2-svn_1.5.1dfsg1-5_powerpc.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn-perl_1.5.1dfsg1-5_powerpc.deb
IBM S/390:: http://security.debian.org/pool/updates/main/s/subversion/python-subversion_1.5.1dfsg1-5_s390.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn-ruby1.8_1.5.1dfsg1-5_s390.deb; http://security.debian.org/pool/updates/main/s/subversion/subversion_1.5.1dfsg1-5_s390.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn-java_1.5.1dfsg1-5_s390.deb; http://security.debian.org/pool/updates/main/s/subversion/libapache2-svn_1.5.1dfsg1-5_s390.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn-perl_1.5.1dfsg1-5_s390.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn1_1.5.1dfsg1-5_s390.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn-dev_1.5.1dfsg1-5_s390.deb
Sun Sparc:: http://security.debian.org/pool/updates/main/s/subversion/libsvn-dev_1.5.1dfsg1-5_sparc.deb; http://security.debian.org/pool/updates/main/s/subversion/libapache2-svn_1.5.1dfsg1-5_sparc.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn-ruby1.8_1.5.1dfsg1-5_sparc.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn-java_1.5.1dfsg1-5_sparc.deb; http://security.debian.org/pool/updates/main/s/subversion/subversion_1.5.1dfsg1-5_sparc.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn1_1.5.1dfsg1-5_sparc.deb; http://security.debian.org/pool/updates/main/s/subversion/python-subversion_1.5.1dfsg1-5_sparc.deb; http://security.debian.org/pool/updates/main/s/subversion/libsvn-perl_1.5.1dfsg1-5_sparc.deb

MD5-kontrollsummor för dessa filer finns i originalbulletinen.