CVE-2016-2167 The canonicalize_username function in svnserve/cyrus_auth.c in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4, when Cyrus SASL authentication is used, allows remote attackers to authenticate a...
MediumCVSS 6.8
EPSS 6.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The canonicalize_username function in svnserve/cyrus_auth.c in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4, when Cyrus SASL authentication is used, allows remote attackers to authenticate and bypass intended access restrictions via a realm string that is a prefix of an expected repository realm string.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/subversion(Debian:12) | < 1.9.4-1 | 1.9.4-1 |
| debian/subversion(Debian:13) | < 1.9.4-1 | 1.9.4-1 |
| debian/subversion(Debian:14) | < 1.9.4-1 | 1.9.4-1 |
| apache subversion | <= 1.8.15 | No fix listed |
| apache subversion | = 1.9.0 | No fix listed |
| apache subversion | = 1.9.1 | No fix listed |
| apache subversion | = 1.9.2 | No fix listed |
| apache subversion | = 1.9.3 | No fix listed |
References
- Debian Security Tracker CVE-2016-2167 vendor-advisory
- FEDORA-2016-20cc04ac50 vendor-advisory
- openSUSE-SU-2016:1263 vendor-advisory
- openSUSE-SU-2016:1264 vendor-advisory
- [subversion-announce] 20160428 [ANNOUNCE][SECURITY] Apache Subversion 1.8.16 released mailing-list
- [subversion-announce] 20160428 [ANNOUNCE][SECURITY] Apache Subversion 1.9.4 released mailing-list
- subversion.apache.org vendor-advisory
- DSA-3561 vendor-advisory
- 89417 vdb-entry
- 1035706 vdb-entry
- SSA:2016-121-01 vendor-advisory
- GLSA-201610-05 vendor-advisory
- www.oracle.com