Improper access control in subversion (Alpine package)

1) Improper access control

EUVDB-ID: #VU32288

Risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2016-2167

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote authenticated user to read and manipulate data.

The canonicalize_username function in svnserve/cyrus_auth.c in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4, when Cyrus SASL authentication is used, allows remote attackers to authenticate and bypass intended access restrictions via a realm string that is a prefix of an expected repository realm string.

Mitigation

Install update from vendor's website.

Vulnerable software versions

subversion (Alpine package): 1.8.4-r0 - 1.8.14-r0

CPE2.3

• cpe:2.3:a:alpine:subversion_alpine_package:1.8.4-r0:*:*:*:*:alpine_linux:*:2.6
• cpe:2.3:a:alpine:subversion_alpine_package:1.8.8-r0:*:*:*:*:alpine_linux:*:2.6
• cpe:2.3:a:alpine:subversion_alpine_package:1.8.9-r0:*:*:*:*:alpine_linux:*:2.7

External links

https://git.alpinelinux.org/aports/commit/?id=fe1d1a2fab1c84836f19bfa20a7e548b8a6ac9dd
https://git.alpinelinux.org/aports/commit/?id=0d0b6cb451564d086ca34469198bd646490a1f51
https://git.alpinelinux.org/aports/commit/?id=bb0c450ee6bb7a95291723179e07be9cab71246d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.