A vulnerability has been reported in Subversion, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to the Subversion client not correctly sanitising the name of files during a checkout or update. This can be exploited to create arbitrary files outside the working directory on a client system by setting up a malicious repository or committing a malicious file (requires commit access) containing directory traversal sequences ("..\") in the file name and tricking a user into checking out or updating the repository.

Successful exploitation requires that the client runs on a system that handles "\" as separator for directories (e.g. Windows).

The vulnerability is reported in version 1.4.4 and prior.

Solution
Update to version 1.4.5.

Provided and/or discovered by
Nils Durner and Christian Grothoff, Colorado Research Institute for Security and Privacy

Original Advisory
http://subversion.tigris.org/servlets/NewsItemView?newsItemID=1941
http://subversion.tigris.org/servlets/ReadMsg?list=users&msgNo=69413

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available in Customer Area