Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
4
CVSSv2

CVE-2014-3528

Published: 19/08/2014 Updated: 30/10/2018
CVSS v2 Base Score: 4 | Impact Score: 4.9 | Exploitability Score: 4.9
VMScore: 356
Vector: AV:N/AC:H/Au:N/C:P/I:P/A:N
Subscribe to Opensuse

Vulnerability Summary

Apache Subversion 1.0.0 up to and including 1.7.x prior to 1.7.17 and 1.8.x prior to 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

opensuse opensuse 12.3

opensuse opensuse 13.1

apache subversion 1.3.0

apache subversion 1.1.0

apache subversion 1.1.1

apache subversion 1.0.3

apache subversion 1.0.4

apache subversion 1.8.8

apache subversion 1.8.9

apache subversion 1.8.6

apache subversion 1.7.16

apache subversion 1.7.14

apache subversion 1.7.15

apache subversion 1.7.2

apache subversion 1.7.9

apache subversion 1.6.0

apache subversion 1.6.15

apache subversion 1.6.16

apache subversion 1.6.23

apache subversion 1.6.3

apache subversion 1.6.4

apache subversion 1.5.1

apache subversion 1.5.2

apache subversion 1.4.0

apache subversion 1.4.1

apache subversion 1.3.1

apache subversion 1.3.2

apache subversion 1.1.2

apache subversion 1.1.3

apache subversion 1.0.5

apache subversion 1.0.6

apache subversion 1.0.7

apache subversion 1.8.0

apache subversion 1.8.1

apache subversion 1.7.0

apache subversion 1.7.1

apache subversion 1.7.3

apache subversion 1.7.4

apache subversion 1.6.1

apache subversion 1.6.10

apache subversion 1.6.17

apache subversion 1.6.18

apache subversion 1.6.5

apache subversion 1.6.6

apache subversion 1.5.3

apache subversion 1.5.4

apache subversion 1.4.2

apache subversion 1.4.3

apache subversion 1.2.2

apache subversion 1.2.3

apache subversion 1.0.1

apache subversion 1.0.2

apache subversion 1.7.17

apache subversion 1.8.7

apache subversion 1.8.4

apache subversion 1.8.5

apache subversion 1.7.12

apache subversion 1.7.13

apache subversion 1.7.7

apache subversion 1.7.8

apache subversion 1.6.13

apache subversion 1.6.14

apache subversion 1.6.20

apache subversion 1.6.21

apache subversion 1.6.9

apache subversion 1.5.0

apache subversion 1.5.7

apache subversion 1.5.8

apache subversion 1.4.6

apache subversion 1.2.0

apache subversion 1.2.1

apache subversion 1.1.4

apache subversion 1.0.0

apache subversion 1.0.8

apache subversion 1.0.9

apache subversion 1.8.2

apache subversion 1.8.3

apache subversion 1.7.10

apache subversion 1.7.11

apache subversion 1.7.5

apache subversion 1.7.6

apache subversion 1.6.11

apache subversion 1.6.12

apache subversion 1.6.19

apache subversion 1.6.2

apache subversion 1.6.7

apache subversion 1.6.8

apache subversion 1.5.5

apache subversion 1.5.6

apache subversion 1.4.4

apache subversion 1.4.5

canonical ubuntu linux 12.04

canonical ubuntu linux 14.04

apple xcode 6.1.1

redhat enterprise linux workstation 6.0

redhat enterprise linux workstation 7.0

redhat enterprise linux server 7.0

redhat enterprise linux hpc node 7.0

redhat enterprise linux desktop 6.0

redhat enterprise linux server 6.0

redhat enterprise linux server eus 6.6.z

redhat enterprise linux hpc node 6.0

redhat enterprise linux desktop 7.0

Vendor Advisories

Ubuntu Security Notice: subversion vulnerabilities
Several security issues were fixed in Subversion ...
Red Hat: Moderate: subversion security update
Synopsis Moderate: subversion security update Type/Severity Security Advisory: Moderate Topic Updated subversion packages that fix two security issues are now availablefor Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having Moderate securityimpact Common Vulnerability Scorin ...
Red Hat: Moderate: subversion security update
Synopsis Moderate: subversion security update Type/Severity Security Advisory: Moderate Topic Updated subversion packages that fix three security issues are nowavailable for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having Moderate securityimpact Common Vulnerability Scor ...
Red Hat: CVE-2014-3528
It was discovered that Subversion clients retrieved cached authentication credentials using the MD5 hash of the server realm string without also checking the server's URL A malicious server able to provide a realm that triggers an MD5 collision could possibly use this flaw to obtain the credentials for a different realm ...

References

CWE-255http://subversion.apache.org/security/CVE-2014-3528-advisory.txthttp://www.ubuntu.com/usn/USN-2316-1http://secunia.com/advisories/60722http://lists.opensuse.org/opensuse-updates/2014-08/msg00038.htmlhttp://lists.apple.com/archives/security-announce/2015/Mar/msg00003.htmlhttps://support.apple.com/HT204427http://rhn.redhat.com/errata/RHSA-2015-0166.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0165.htmlhttp://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.htmlhttp://www.securityfocus.com/bid/68995http://secunia.com/advisories/59584http://secunia.com/advisories/59432https://security.gentoo.org/glsa/201610-05https://usn.ubuntu.com/2316-1/https://nvd.nist.govhttps://access.redhat.com/security/cve/cve-2014-3528
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-30924CVE-2024-3400overflowCVE-2024-23528CVE-2024-21338CVE-2024-3818CVE-2024-23535NULL pointer dereferenceelevation of privilege
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook