Executive Summary
| Informations | |||
|---|---|---|---|
| Name | MDVSA-2014:161 | First vendor Publication | 2014-09-02 |
| Vendor | Mandriva | Last vendor Modification | 2014-09-02 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:H/Au:N/C:P/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 4 | Attack Range | Network |
| Cvss Impact Score | 4.9 | Attack Complexity | High |
| Cvss Expoit Score | 4.9 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Updated subversion packages fix security vulnerability: Bert Huijben discovered that Subversion did not properly handle cached credentials. A malicious server could possibly use this issue to obtain credentials cached for a different server (CVE-2014-3528). |
Original Source
| Url : http://www.mandriva.com/security/advisories?name=MDVSA-2014:161 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-255 | Credentials Management |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:25847 | |||
| Oval ID: | oval:org.mitre.oval:def:25847 | ||
| Title: | USN-2316-1 -- subversion vulnerabilities | ||
| Description: | Several security issues were fixed in Subversion. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-2316-1 CVE-2014-0032 CVE-2014-3522 CVE-2014-3528 | Version: | 3 |
| Platform(s): | Ubuntu 14.04 Ubuntu 12.04 | Product(s): | subversion |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:26362 | |||
| Oval ID: | oval:org.mitre.oval:def:26362 | ||
| Title: | Apache Subversion vulnerability Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials | ||
| Description: | Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2014-3528 | Version: | 5 |
| Platform(s): | Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows 8.1 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Server 2012 R2 | Product(s): | VisualSVN Server |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2016-10-12 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201610-05.nasl - Type : ACT_GATHER_INFO |
| 2015-03-30 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2015-085.nasl - Type : ACT_GATHER_INFO |
| 2015-03-11 | Name : The remote host has an application installed that is affected by multiple vul... File : macosx_xcode_6_2.nasl - Type : ACT_GATHER_INFO |
| 2015-02-12 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20150210_subversion_on_SL7_x.nasl - Type : ACT_GATHER_INFO |
| 2015-02-12 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20150210_subversion_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
| 2015-02-11 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2015-0165.nasl - Type : ACT_GATHER_INFO |
| 2015-02-11 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2015-0166.nasl - Type : ACT_GATHER_INFO |
| 2015-02-11 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2015-0165.nasl - Type : ACT_GATHER_INFO |
| 2015-02-11 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2015-0166.nasl - Type : ACT_GATHER_INFO |
| 2015-02-11 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2015-0166.nasl - Type : ACT_GATHER_INFO |
| 2015-02-11 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2015-0165.nasl - Type : ACT_GATHER_INFO |
| 2014-10-06 | Name : The remote host has an application that is affected by multiple vulnerabilities. File : subversion_1_8_10.nasl - Type : ACT_GATHER_INFO |
| 2014-09-12 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2014-161.nasl - Type : ACT_GATHER_INFO |
| 2014-08-29 | Name : The remote Fedora host is missing a security update. File : fedora_2014-9521.nasl - Type : ACT_GATHER_INFO |
| 2014-08-25 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-511.nasl - Type : ACT_GATHER_INFO |
| 2014-08-15 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-2316-1.nasl - Type : ACT_GATHER_INFO |
| 2014-08-12 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_83a418cc218211e4802c20cf30e32f6d.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-09-13 13:43:09 |
|
| 2014-09-02 17:21:45 |
|
