CVE-2004-0397 Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1.0.2 and earlier allows remote attackers to execute arbitrary code via a (1) DAV2 REPORT query or (2) get-dated-rev svn...
HighCVSS 7.5
EPSS 75.3%
Framework module
Public exploit
PoC
- Published
- Updated
- Exploit status
- Public exploit available
Description
Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1.0.2 and earlier allows remote attackers to execute arbitrary code via a (1) DAV2 REPORT query or (2) get-dated-rev svn-protocol command.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| subversion | = 1.0 | No fix listed |
| subversion | = 1.0.1 | No fix listed |
| subversion | = 1.0.2 | No fix listed |
| debian/subversion(Debian:12) | < 1.0.3-1 | 1.0.3-1 |
| debian/subversion(Debian:13) | < 1.0.3-1 | 1.0.3-1 |
| debian/subversion(Debian:14) | < 1.0.3-1 | 1.0.3-1 |
References
- Debian Security Tracker CVE-2004-0397 vendor-advisory
- bugs.debian.org issue-tracking
- 20040519 Advisory 08/2004: Subversion remote vulnerability mailing-list
- 20040519 Advisory 08/2004: Subversion remote vulnerability mailing-list
- 11642 third-party-advisory
- 11675 third-party-advisory
- security.e-matters.de
- subversion.tigris.org
- GLSA-200405-14 vendor-advisory
- FEDORA-2004-128 vendor-advisory
- 6301 vdb-entry
- 20040519 [OpenPKG-SA-2004.023] OpenPKG Security Advisory (subversion) mailing-list patch vendor-advisory
- 10386 exploit patch vdb-entry vendor-advisory
- FLSA:1748 vendor-advisory
- subversion-date-parsing-command-execution(16191) vdb-entry