Bug 21495 - subversion new security issue CVE-2017-9800
Summary: subversion new security issue CVE-2017-9800
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 6
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA5TOO has_procedure MGA5-64-OK advi...
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2017-08-11 04:02 CEST by David Walser
Modified: 2017-08-16 23:11 CEST (History)
4 users (show)

See Also:
Source RPM: subversion-1.9.6-1.mga6.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2017-08-11 04:02:50 CEST
Apache has released Subversion 1.9.7 today (August 10), fixing a security issue:
https://mail-archives.apache.org/mod_mbox/subversion-announce/201708.mbox/%3C2fefe468-7d41-11e7-aea1-9312c6089150%40apache.org%3E
http://svn.apache.org/repos/asf/subversion/tags/1.9.7/CHANGES

1.8.19 also fixes the same issue:
http://mail-archives.apache.org/mod_mbox/subversion-announce/201708.mbox/%3C8760dvl2j6.fsf%40codematters.co.uk%3E
http://svn.apache.org/repos/asf/subversion/tags/1.8.19/CHANGES

Updated packages uploaded for Mageia 5, Mageia 6, and Cauldron.

Advisory:
========================

Updated subversion packages fix security vulnerability:

A Subversion client sometimes connects to URLs provided by the repository. A
maliciously constructed svn+ssh:// URL would cause Subversion clients to run
an arbitrary shell command.  Such a URL could be generated by a malicious
server, by a malicious user committing to a honest server (to attack another
user of that server's repositories), or by a proxy server (CVE-2017-9800).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9800
https://mail-archives.apache.org/mod_mbox/subversion-announce/201708.mbox/%3C2fefe468-7d41-11e7-aea1-9312c6089150%40apache.org%3E
http://svn.apache.org/repos/asf/subversion/tags/1.9.7/CHANGES
http://mail-archives.apache.org/mod_mbox/subversion-announce/201708.mbox/%3C8760dvl2j6.fsf%40codematters.co.uk%3E
http://svn.apache.org/repos/asf/subversion/tags/1.8.19/CHANGES
http://subversion.apache.org/security/CVE-2017-9800-advisory.txt
========================

Updated packages in core/updates_testing:
========================
subversion-1.8.19-1.mga5
subversion-doc-1.8.19-1.mga5
libsvn0-1.8.19-1.mga5
libsvn-gnome-keyring0-1.8.19-1.mga5
libsvn-kwallet0-1.8.19-1.mga5
subversion-server-1.8.19-1.mga5
subversion-tools-1.8.19-1.mga5
python-svn-1.8.19-1.mga5
ruby-svn-1.8.19-1.mga5
libsvnjavahl1-1.8.19-1.mga5
svn-javahl-1.8.19-1.mga5
perl-SVN-1.8.19-1.mga5
subversion-kwallet-devel-1.8.19-1.mga5
subversion-gnome-keyring-devel-1.8.19-1.mga5
perl-svn-devel-1.8.19-1.mga5
python-svn-devel-1.8.19-1.mga5
ruby-svn-devel-1.8.19-1.mga5
subversion-devel-1.8.19-1.mga5
apache-mod_dav_svn-1.8.19-1.mga5
subversion-1.9.7-1.mga6
subversion-doc-1.9.7-1.mga6
libsvn0-1.9.7-1.mga6
libsvn-gnome-keyring0-1.9.7-1.mga6
subversion-server-1.9.7-1.mga6
subversion-tools-1.9.7-1.mga6
python-svn-1.9.7-1.mga6
ruby-svn-1.9.7-1.mga6
libsvnjavahl1-1.9.7-1.mga6
svn-javahl-1.9.7-1.mga6
perl-SVN-1.9.7-1.mga6
subversion-gnome-keyring-devel-1.9.7-1.mga6
perl-svn-devel-1.9.7-1.mga6
python-svn-devel-1.9.7-1.mga6
ruby-svn-devel-1.9.7-1.mga6
subversion-devel-1.9.7-1.mga6
apache-mod_dav_svn-1.9.7-1.mga6

from SRPMS:
subversion-1.8.19-1.mga5.src.rpm
subversion-1.9.7-1.mga6.src.rpm
Comment 1 David Walser 2017-08-11 04:03:05 CEST
Testing procedure:
https://bugs.mageia.org/show_bug.cgi?id=14826#c2

Whiteboard: (none) => MGA5TOO has_procedure

Comment 2 PC LX 2017-08-13 19:31:14 CEST
Installed and tested without issues. Tested with local and remote repositories, new and existing repositories.

$ rpm -qa | egrep -i 'lib(64)?svn|perl-svn|subversion' | sort
lib64svn0-1.8.19-1.mga5
perl-SVN-1.8.19-1.mga5
subversion-1.8.19-1.mga5
subversion-tools-1.8.19-1.mga5

Whiteboard: MGA5TOO has_procedure => MGA5TOO has_procedure MGA5-64-OK
CC: (none) => mageia

Lewis Smith 2017-08-13 20:17:11 CEST

Whiteboard: MGA5TOO has_procedure MGA5-64-OK => MGA5TOO has_procedure MGA5-64-OK advisory
CC: (none) => lewyssmith

Comment 3 Len Lawrence 2017-08-16 17:45:29 CEST
mga6  x86_64

Installed all the packages:
# rpm -qa | egrep -i 'svn|subversion' | grep -v bcel | grep -v atin | sort
apache-mod_dav_svn-1.9.7-1.mga6
lib64svn0-1.9.7-1.mga6
lib64svn-gnome-keyring0-1.9.7-1.mga6
lib64svnjavahl1-1.9.7-1.mga6
perl-SVN-1.9.7-1.mga6
perl-svn-devel-1.9.7-1.mga6
python-svn-1.9.7-1.mga6
python-svn-devel-1.9.7-1.mga6
ruby-svn-1.9.7-1.mga6
ruby-svn-devel-1.9.7-1.mga6
subversion-1.9.7-1.mga6
subversion-devel-1.9.7-1.mga6
subversion-doc-1.9.7-1.mga6
subversion-gnome-keyring-devel-1.9.7-1.mga6
subversion-server-1.9.7-1.mga6
subversion-tools-1.9.7-1.mga6
svn-javahl-1.9.7-1.mga6

Repeating the steps of previous testers to create a dummy SVN repository:

$ svnadmin create --fs-type fsfs /home/lcl/svn
$ ls -l ~/svn
total 24
drwxr-xr-x 2 lcl lcl 4096 Aug 16 15:33 conf/
drwxr-sr-x 6 lcl lcl 4096 Aug 16 15:33 db/
-r--r--r-- 1 lcl lcl    2 Aug 16 15:33 format
drwxr-xr-x 2 lcl lcl 4096 Aug 16 15:33 hooks/
drwxr-xr-x 2 lcl lcl 4096 Aug 16 15:33 locks/
-rw-r--r-- 1 lcl lcl  246 Aug 16 15:33 README.txt
$ mkdir qa/project
$ cd qa/project
$ mkdir bin src doc
$ echo test > doc/index.html
$ echo whatever > src/Makefile
$ svn import /home/lcl/qa/project/ file:///home/lcl/svn/project/trunk -m 'Initial import'
Adding         bin
Adding         doc
Adding         doc/index.html
Adding         src
Adding         src/Makefile
Committing transaction...
Committed revision 1.
$ rm -rf project
$ cd
$ svn checkout file:///home/lcl/svn/project
A    project/trunk
A    project/trunk/bin
A    project/trunk/doc
A    project/trunk/doc/index.html
A    project/trunk/src
A    project/trunk/src/Makefile
Checked out revision 1.

Could not proceed with the apache demo:
The system geography has changed a little since Claire and Dave's tests.
The httpd modules configurations are now at /etc/httpd/conf/modules.d but there is no 46_mod_dav_svn.conf.  I hesitate to modify 10_mod_dav_svn.conf because that seems to be concerned solely with setting up load module links.

Does anybody have any idea what file needs to be modified now or if there is a replacement for 46_mod_dav_svn.conf?  Or maybe it needs to be generated somehow?
Creating the file myself with this stanza:
-----------------------------
<IfModule mod_dav_svn.c>
     <Location /svn/repos>
        DAV svn
        SVNPath /home/lcl/svn
     </Location>
</IfModule>
----------------------------
did the trick.
Restarting httpd and pointing firefox at http://localhost/svn/repos brought up a page with:
"repos - Revision 1: project
project/

The dummy project could be followed down the links.
This is as far as it goes.  No PoC available.
Thanks to Claire, Dave, David, Herman and PC LX for tips on all this.
Just noticed Dave's pointer to /etc/httpd/conf/conf.d/subversion.conf.  Ah well.

CC: (none) => tarazed25

Len Lawrence 2017-08-16 17:46:00 CEST

Whiteboard: MGA5TOO has_procedure MGA5-64-OK advisory => MGA5TOO has_procedure MGA5-64-OK advisory MGA6-64-OK

Comment 4 Lewis Smith 2017-08-16 22:13:01 CEST
And thanks to Len for your usual persistant testing!
Validating as this has a 64-bit OK per release.

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 5 Mageia Robot 2017-08-16 23:11:36 CEST
An update for this issue has been pushed to the Mageia Updates repository.

http://advisories.mageia.org/MGASA-2017-0273.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.