Bug 1000202 - (CVE-2013-4277) CVE-2013-4277 subversion: svnserve is vulnerable to symlink attack
CVE-2013-4277 subversion: svnserve is vulnerable to symlink attack
Status: CLOSED WONTFIX
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
impact=low,public=20130830,reported=2...
: Security
Depends On: 1003070 1003071
Blocks: 1000203
  Show dependency treegraph
 
Reported: 2013-08-22 18:48 EDT by Vincent Danen
Modified: 2015-10-15 13:57 EDT (History)
3 users (show)

See Also:
Fixed In Version: subversion 1.7.12, subversion 1.8.3
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2014-02-12 23:54:01 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)
upstream patch to fix CVE-2013-4277 in subversion 1.8.x (816 bytes, patch)
2013-08-22 18:50 EDT, Vincent Danen
no flags Details | Diff

  None (edit)
Description Vincent Danen 2013-08-22 18:48:14 EDT
It was reported that the Subversion svnserve daemon is vulnerable to a symlink attack when the --pid-file argument is passed to it.  If the PID file were written in a directory that is writable by an unprivileged user, that user could create a symlink to a file that would be overwritten with the privilges of the svnserve daemon (typically root).  As well, because the initscripts read the contents of the file to determine which process to kill on service shutdown, if it were symlinked to a file writable by the local user, they could replace the contents of the file with another application's pid, which would cause a different application to be killed when the svnserve initscript is called to stop the service.

By default, Red Hat Enterprise Linux and Fedora call svnserve with '--pid-file=/run/svnserve/svnserve.pid' (Fedora) or '--pid-file=/var/run/svnserve.pid' (Red Hat Enterprise Linux).  These directories are not writable by unprivileged users.


Acknowledgements:

Red Hat would like to thank Ben Reser of the Apache Subversion project for reporting this issue. Upstream acknowledges Daniel Shahaf of elego Software Solutions GmbH as the original issue reporter.
Comment 1 Vincent Danen 2013-08-22 18:49:13 EDT
This issue is embargoed until 29 August 2013 17:00 UTC.
Comment 2 Vincent Danen 2013-08-22 18:50:12 EDT
Created attachment 789398 [details]
upstream patch to fix CVE-2013-4277 in subversion 1.8.x
Comment 5 Vincent Danen 2013-08-30 12:46:19 EDT
External References:

http://subversion.apache.org/security/CVE-2013-4277-advisory.txt
Comment 8 Vincent Danen 2013-08-30 12:52:23 EDT
Created subversion tracking bugs for this issue:

Affects: fedora-all [bug 1003070]
Comment 9 Fedora Update System 2013-09-07 20:33:16 EDT
subversion-1.7.13-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 10 Huzaifa S. Sidhpurwala 2014-02-12 23:50:18 EST
As mentioned in comment #0, Red Hat and Fedora versions of subversion package are not vulnerable to this issue, because they create the pid files at a secure location (not writable by unprivileged users).

The only way this flaw could be exploited was if a root user changed the default location of the creation of pid files via "/etc/sysconfig/svnserve" or "/etc/init.d/svnserve" to a directory writable by unprivileged users.

Therefore, The Red Hat Security Response Team, does not consider this issue as a security flaw.
Comment 11 Huzaifa S. Sidhpurwala 2014-02-12 23:54:01 EST
Statement:

The Red Hat Security Response Team does not consider this issue to be a security flaw. For technical details please refer to https://bugzilla.redhat.com/show_bug.cgi?id=1000202#c10

Note You need to log in before you can comment on or make changes to this bug.