CVE-2004-0397

Current Description

Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1.0.2 and earlier allows remote attackers to execute arbitrary code via a (1) DAV2 REPORT query or (2) get-dated-rev svn-protocol command.

Basic Data

PublishedJuly 07, 2004
Last ModifiedJuly 11, 2017
Assignercve@mitre.org
Data TypeCVE
Data FormatMITRE
Data Version4.0
Problem TypeNVD-CWE-Other
CVE Data Version4.0

Base Metric V2

CVSS 2 - Version2.0
CVSS 2 - Vector StringAV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS 2 - Access VectorNETWORK
CVSS 2 - Access ComplexityLOW
CVSS 2 - AuthenticationNONE
CVSS 2 - Confidentiality ImpactPARTIAL
CVSS 2 - Availability ImpactPARTIAL
CVSS 2 - Base Score7.5
SeverityHIGH
Exploitability Score10.0
Impact Score6.4
Obtain All Privilegefalse
Obtain User Privilegefalse
Obtain Other Privilegetrue

Base Metric V3

No data provided.

Configurations

  • OR - Configuration 1
    Cpe VersionPartVendorProductVersionUpdateEditionLanguageSW EditionTarget SWTarget HWOtherVersion Start IncludingVersion End IncludingVersion Start ExcludingVersion End Excluding
    2.3ApplicationSubversionSubversion1.0*******
    2.3ApplicationSubversionSubversion1.0.1*******
    2.3ApplicationSubversionSubversion1.0.2*******

Vulnerable Software List

VendorProductVersions
Subversion Subversion 1.0, 1.0.1, 1.0.2

References

NameSourceURLTags
20040519 Advisory 08/2004: Subversion remote vulnerabilityhttp://lists.grok.org.uk/pipermail/full-disclosure/2004-May/021737.htmlFULLDISC
20040519 Advisory 08/2004: Subversion remote vulnerabilityhttp://marc.info/?l=bugtraq&m=108498676517697&w=2BUGTRAQ
11642http://secunia.com/advisories/11642SECUNIA
11675http://secunia.com/advisories/11675SECUNIA
http://security.e-matters.de/advisories/082004.htmlhttp://security.e-matters.de/advisories/082004.htmlMISC
http://subversion.tigris.org/svn-sscanf-advisory.txthttp://subversion.tigris.org/svn-sscanf-advisory.txtCONFIRM
GLSA-200405-14http://www.gentoo.org/security/en/glsa/glsa-200405-14.xmlGENTOO
FEDORA-2004-128http://www.linuxsecurity.com/advisories/fedora_advisory-4373.htmlFEDORAVendor Advisory
6301http://www.osvdb.org/6301OSVDB
20040519 [OpenPKG-SA-2004.023] OpenPKG Security Advisory (subversion)http://www.securityfocus.com/archive/1/363814BUGTRAQPATCH Vendor Advisory
10386http://www.securityfocus.com/bid/10386BIDExploit PATCH Vendor Advisory
FLSA:1748https://bugzilla.fedora.us/show_bug.cgi?id=1748FEDORA
subversion-date-parsing-command-execution(16191)https://exchange.xforce.ibmcloud.com/vulnerabilities/16191XF