National Cyber Awareness System

Vulnerability Summary for CVE-2010-4644

Overview

Multiple memory leaks in rev_hunt.c in Apache Subversion before 1.6.15 allow remote authenticated users to cause a denial of service (memory consumption and daemon crash) via the -g option to the blame command.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: XF

Name: subversion-blameg-dos(64473)

Hyperlink:http://xforce.iss.net/xforce/xfdb/64473

External Source: VUPEN

Name: ADV-2011-0264

Hyperlink:http://www.vupen.com/english/advisories/2011/0264

External Source: VUPEN

Name: ADV-2011-0162

Hyperlink:http://www.vupen.com/english/advisories/2011/0162

External Source: VUPEN

Name: ADV-2011-0103

Hyperlink:http://www.vupen.com/english/advisories/2011/0103

External Source: VUPEN

Name: ADV-2011-0015

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2011/0015

External Source: UBUNTU

Name: USN-1053-1

Hyperlink:http://www.ubuntu.com/usn/USN-1053-1

External Source: SECTRACK

Name: 1024935

Hyperlink:http://www.securitytracker.com/id?1024935

External Source: BID

Name: 45655

Hyperlink:http://www.securityfocus.com/bid/45655

External Source: REDHAT

Name: RHSA-2011:0258

Hyperlink:http://www.redhat.com/support/errata/RHSA-2011-0258.html

External Source: REDHAT

Name: RHSA-2011:0257

Hyperlink:http://www.redhat.com/support/errata/RHSA-2011-0257.html

External Source: MANDRIVA

Name: MDVSA-2011:006

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2011:006

External Source: MLIST

Name: [dev] 20101104 "svn blame -g" causing svnserve to hang & mem usage to hit 2GB

Hyperlink:http://svn.haxx.se/dev/archive-2010-11/0102.shtml

External Source: CONFIRM

Name: http://svn.apache.org/viewvc?view=revision&revision=1032808

Hyperlink:http://svn.apache.org/viewvc?view=revision&revision=1032808

External Source: CONFIRM

Name: http://svn.apache.org/repos/asf/subversion/tags/1.6.15/CHANGES

Hyperlink:http://svn.apache.org/repos/asf/subversion/tags/1.6.15/CHANGES

External Source: SECUNIA

Name: 43346

Hyperlink:http://secunia.com/advisories/43346

External Source: SECUNIA

Name: 43139

Hyperlink:http://secunia.com/advisories/43139

External Source: SECUNIA

Name: 43115

Hyperlink:http://secunia.com/advisories/43115

External Source: SECUNIA

Name: 42969

Hyperlink:http://secunia.com/advisories/42969

External Source: SECUNIA

Name: 42780

Type: Advisory

Hyperlink:http://secunia.com/advisories/42780

External Source: MLIST

Name: [oss-security] 20110105 Re: CVE request for subversion

Hyperlink:http://openwall.com/lists/oss-security/2011/01/05/4

External Source: MLIST

Name: [oss-security] 20110104 Re: CVE request for subversion

Hyperlink:http://openwall.com/lists/oss-security/2011/01/04/8

External Source: MLIST

Name: [oss-security] 20110104 Re: CVE request for subversion

Hyperlink:http://openwall.com/lists/oss-security/2011/01/04/10

External Source: MLIST

Name: [oss-security] 20110102 CVE request for subversion

Hyperlink:http://openwall.com/lists/oss-security/2011/01/02/1

External Source: MLIST

Name: [www-announce] 20101124 Apache Subversion 1.6.15 Released

Hyperlink:http://mail-archives.apache.org/mod_mbox/www-announce/201011.mbox/%3CAANLkTi=5+NOi-Cp=fKCx6mAW-TofFVW=ikEQkXgQB8Bt@mail.gmail.com%3E

External Source: MLIST

Name: [subversion-users] 20101104 svnserve.exe (Win32) using 2GB of memory and then crashing?

Hyperlink:http://mail-archives.apache.org/mod_mbox/subversion-users/201011.mbox/%3C4CD33B61.7030203@thepond.com%3E

External Source: FEDORA

Name: FEDORA-2011-0099

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053230.html