Bug 1205138 (CVE-2015-0248)

Summary:
========

  Subversion's mod_dav_svn and svnserve servers will trigger an assertion
  while processing some requests with special parameters, which are evaluated
  on the server side.  Assertion will cause svnserve process or the process
  hosting mod_dav_svn module (Apache) to abort.

  This can lead to a DoS.  There are no known instances of this problem
  being exploited in the wild, but an exploit has been tested.

Details:
========

  Subversion's http:// and svn:// protocol support includes certain request
  types with parameters, which are evaluated on the server side.  As an
  example, sometimes clients need to trace the history of the object to its
  origin, while not knowing the exact value of the origin (revision number)
  prior to issuing the request.

  Certain parameter combinations can exploit this behavior and force a server
  into attempting an operation with invalid arguments.  Subversion servers
  guard against these situations with assertion statements, and the default
  behavior for a failed assertion is to abort the current process.

Severity:
=========

  CVSSv2 Base Score: 5.0
  CVSSv2 Base Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

  We consider this to be a medium risk vulnerability.

  Apache HTTPD servers with repositories that allow anonymous reads will be
  vulnerable without authentication.  Many Apache servers will respawn the
  listener processes, but a determined attacker will be able to crash these
  processes as they appear, denying service to legitimate users.  Servers
  using threaded MPMs will close the connection on other clients being
  served by the same process that services the request from the attacker.
  In either case there is an increased processing impact of restarting a
  process and the cost of per process caches being lost.

  Exploiting this behavior against svnserve does not require an attacker to
  authenticate.  A remote attacker can cause svnserve process to terminate
  and thus deny service to users of the server.

  Unfortunately, no special configuration is required and all mod_dav_svn
  and svnserve servers are vulnerable.

Recommendations:
================

  No known workarounds are available.

Acknowledgements:

Red Hat would like to thank the Apache Software Foundation for reporting this issue. Upstream acknowledges Evgeny Kotkov of VisualSVN as the original reporter.