The mod_authz_svn Apache module for Subversion 1.0.4-r1 and earlier allows remote authenticated users, with write access to the repository, to read unauthorized parts of the repository via the svn copy command.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Subversion | Subversion | 1.0 (including) | 1.0 (including) |
| Subversion | Subversion | 1.0.1 (including) | 1.0.1 (including) |
| Subversion | Subversion | 1.0.2 (including) | 1.0.2 (including) |
| Subversion | Subversion | 1.0.3 (including) | 1.0.3 (including) |
| Subversion | Subversion | 1.0.4 (including) | 1.0.4 (including) |
| Subversion | Subversion | 1.0.5 (including) | 1.0.5 (including) |
References
- http://securityreason.com/securityalert/60
- http://securitytracker.com/id?1010779
- http://svn.collab.net/repos/svn/tags/1.0.6/CHANGES
- http://www.gentoo.org/security/en/glsa/glsa-200407-20.xml
- http://www.securityfocus.com/bid/10800
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16803
- http://securityreason.com/securityalert/60
- http://securitytracker.com/id?1010779
- http://svn.collab.net/repos/svn/tags/1.0.6/CHANGES
- http://www.gentoo.org/security/en/glsa/glsa-200407-20.xml
- http://www.securityfocus.com/bid/10800
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16803