Mailing-List: contact users-help@subversion.apache.org; run by ezmlm
Precedence: bulk
Received-SPF: neutral (athena.apache.org: local policy)
MIME-Version: 1.0
In-Reply-To: <20121022125408.GB15478@ted.stsp.name>
References: 
 <CAGiKjumzQS+JqP9iEwc1=p_y+MGpS-Dv3V6=vBwPi4tvP_dSpw@mail.gmail.com>
	<20121022125408.GB15478@ted.stsp.name>
Date: Mon, 22 Oct 2012 08:58:49 -0400
Message-ID: 
 <CAGiKju=wyja9M76FQ9QNuGTX+B10k7qAZA_YR5u+Zn=i1+fjcA@mail.gmail.com>
Subject: Re: Subversion upgrade problem
From: Parrish Knight <parrish.knight@noaa.gov>
To: users@subversion.apache.org
Content-Type: text/plain; charset=ISO-8859-1

On Mon, Oct 22, 2012 at 8:54 AM, Stefan Sperling <stsp@elego.de> wrote:
> On Mon, Oct 22, 2012 at 08:43:16AM -0400, Parrish Knight wrote:
>> Good morning:
>>
>> I am the Help Desk Lead at the National Geodetic Survey, an agency of
>> NOAA, the National Oceanic and Atmospheric Administration.  Currently,
>> I am in the process of migrating one of our developers from a rather
>> aged desktop to a more modern laptop.  Part of our upgrade procedue is
>> for our security officer to scan all new seats for vulnerabilities
>> before approving them for release to the end user.  I've got a bit of
>> a puzzler regarding a vulnerability in Subversion, and I have not been
>> able to locate a remedy.  The recommended remedy is to uninstall all
>> previous versions of Subversion and install the most recent version
>> (currently 1.7.7).  I followed this procedure, but our security
>> officer reported that the problem persists.
>
> Hi,
>
> which problem do you mean exactly?

The reported problem is with earlier versions of Subversion, but our
security officer reports that the problem persists even after an
upgrade.

"Multiple integer overflows in the libsvn_delta library in Subversion
before 1.5.7, and 1.6.x before 1.6.4, allow remote authenticated users
and remote Subversion servers to execute arbitrary code via an svndiff
stream with large windows that trigger a heap-based buffer overflow, a
related issue to CVE-2009-2412."

http://www.orvant.com/vuln/detail/181334/CVE-2009-2411

-- 
Parrish S. Knight
NGS Help Desk Lead
301-713-3254 x184
parrish.knight@noaa.gov