Secunia

ned has reported a vulnerability in Subversion, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a vulnerable system.

The vulnerability is caused due to missing string length checks in the svn protocol, since the parser just trusts the string lengths provided by a client. This can be exploited to cause an "out-of-bounds" write error or heap-based buffer overflow by specifying an overly large string length.

Successful exploitation crashes the service and may potentially allow arbitrary code execution. However, exploitation requires that svnserve is running.

The vulnerability affects version 1.0.4 and prior.

Solution
Update to version 1.0.5:
Further details available in Customer Area

Provided and/or discovered by
ned

Original Advisory
Subversion:
http://subversion.tigris.org/security/CAN-2004-0413-advisory.txt

Deep Links
Links available in Customer Area