CVE-2014-3528 Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers t...
MediumCVSS 4.0
EPSS 7.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/subversion(Debian:12) | < 1.8.10-1 | 1.8.10-1 |
| debian/subversion(Debian:13) | < 1.8.10-1 | 1.8.10-1 |
| debian/subversion(Debian:14) | < 1.8.10-1 | 1.8.10-1 |
| opensuse | = 12.3 | No fix listed |
| opensuse | = 13.1 | No fix listed |
| apache subversion | = 1.0.0 | No fix listed |
| apache subversion | = 1.0.1 | No fix listed |
| apache subversion | = 1.0.2 | No fix listed |
| apache subversion | = 1.0.3 | No fix listed |
| apache subversion | = 1.0.4 | No fix listed |
| apache subversion | = 1.0.5 | No fix listed |
| apache subversion | = 1.0.6 | No fix listed |
| apache subversion | = 1.0.7 | No fix listed |
| apache subversion | = 1.0.8 | No fix listed |
| apache subversion | = 1.0.9 | No fix listed |
| apache subversion | = 1.1.0 | No fix listed |
| apache subversion | = 1.1.1 | No fix listed |
| apache subversion | = 1.1.2 | No fix listed |
| apache subversion | = 1.1.3 | No fix listed |
| apache subversion | = 1.1.4 | No fix listed |
| apache subversion | = 1.2.0 | No fix listed |
| apache subversion | = 1.2.1 | No fix listed |
| apache subversion | = 1.2.2 | No fix listed |
| apache subversion | = 1.2.3 | No fix listed |
| apache subversion | = 1.3.0 | No fix listed |
Show 81 more
| Product | Affected versions | Fixed in |
|---|---|---|
| apache subversion | = 1.3.1 | No fix listed |
| apache subversion | = 1.3.2 | No fix listed |
| apache subversion | = 1.4.0 | No fix listed |
| apache subversion | = 1.4.1 | No fix listed |
| apache subversion | = 1.4.2 | No fix listed |
| apache subversion | = 1.4.3 | No fix listed |
| apache subversion | = 1.4.4 | No fix listed |
| apache subversion | = 1.4.5 | No fix listed |
| apache subversion | = 1.4.6 | No fix listed |
| apache subversion | = 1.5.0 | No fix listed |
| apache subversion | = 1.5.1 | No fix listed |
| apache subversion | = 1.5.2 | No fix listed |
| apache subversion | = 1.5.3 | No fix listed |
| apache subversion | = 1.5.4 | No fix listed |
| apache subversion | = 1.5.5 | No fix listed |
| apache subversion | = 1.5.6 | No fix listed |
| apache subversion | = 1.5.7 | No fix listed |
| apache subversion | = 1.5.8 | No fix listed |
| apache subversion | = 1.6.0 | No fix listed |
| apache subversion | = 1.6.1 | No fix listed |
| apache subversion | = 1.6.2 | No fix listed |
| apache subversion | = 1.6.3 | No fix listed |
| apache subversion | = 1.6.4 | No fix listed |
| apache subversion | = 1.6.5 | No fix listed |
| apache subversion | = 1.6.6 | No fix listed |
| apache subversion | = 1.6.7 | No fix listed |
| apache subversion | = 1.6.8 | No fix listed |
| apache subversion | = 1.6.9 | No fix listed |
| apache subversion | = 1.6.10 | No fix listed |
| apache subversion | = 1.6.11 | No fix listed |
| apache subversion | = 1.6.12 | No fix listed |
| apache subversion | = 1.6.13 | No fix listed |
| apache subversion | = 1.6.14 | No fix listed |
| apache subversion | = 1.6.15 | No fix listed |
| apache subversion | = 1.6.16 | No fix listed |
| apache subversion | = 1.6.17 | No fix listed |
| apache subversion | = 1.6.18 | No fix listed |
| apache subversion | = 1.6.19 | No fix listed |
| apache subversion | = 1.6.20 | No fix listed |
| apache subversion | = 1.6.21 | No fix listed |
| apache subversion | = 1.6.23 | No fix listed |
| apache subversion | = 1.7.0 | No fix listed |
| apache subversion | = 1.7.1 | No fix listed |
| apache subversion | = 1.7.2 | No fix listed |
| apache subversion | = 1.7.3 | No fix listed |
| apache subversion | = 1.7.4 | No fix listed |
| apache subversion | = 1.7.5 | No fix listed |
| apache subversion | = 1.7.6 | No fix listed |
| apache subversion | = 1.7.7 | No fix listed |
| apache subversion | = 1.7.8 | No fix listed |
| apache subversion | = 1.7.9 | No fix listed |
| apache subversion | = 1.7.10 | No fix listed |
| apache subversion | = 1.7.11 | No fix listed |
| apache subversion | = 1.7.12 | No fix listed |
| apache subversion | = 1.7.13 | No fix listed |
| apache subversion | = 1.7.14 | No fix listed |
| apache subversion | = 1.7.15 | No fix listed |
| apache subversion | = 1.7.16 | No fix listed |
| apache subversion | = 1.7.17 | No fix listed |
| apache subversion | = 1.8.0 | No fix listed |
| apache subversion | = 1.8.1 | No fix listed |
| apache subversion | = 1.8.2 | No fix listed |
| apache subversion | = 1.8.3 | No fix listed |
| apache subversion | = 1.8.4 | No fix listed |
| apache subversion | = 1.8.5 | No fix listed |
| apache subversion | = 1.8.6 | No fix listed |
| apache subversion | = 1.8.7 | No fix listed |
| apache subversion | = 1.8.8 | No fix listed |
| apache subversion | = 1.8.9 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| apple Xcode | = 6.1.1 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux hpc node | = 6.0 | No fix listed |
| redhat enterprise linux hpc node | = 7.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server eus | = 6.6.z | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
References
- Debian Security Tracker CVE-2014-3528 vendor-advisory
- APPLE-SA-2015-03-09-4 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2014:1059 third-party-advisory vendor-advisory
- RHSA-2015:0165 third-party-advisory vendor-advisory
- RHSA-2015:0166 third-party-advisory vendor-advisory
- 59432 third-party-advisory
- 59584 third-party-advisory
- 60722 third-party-advisory
- subversion.apache.org vendor-advisory
- www.oracle.com
- 68995 vdb-entry
- USN-2316-1 vendor-advisory
- GLSA-201610-05 vendor-advisory
- support.apple.com third-party-advisory