NVD Vulnerability Detail

CVE-2014-3528

Summary	Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm.
Publication Date	Aug. 20, 2014, 3:55 a.m.
Registration Date	Jan. 26, 2021, 3:10 p.m.
Last Update	Nov. 21, 2024, 11:08 a.m.

CVSS2.0 : MEDIUM
Score	4.0
Vector	AV:N/AC:H/Au:N/C:P/I:P/A:N
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	高
攻撃前の認証要否(Au)	不要
機密性への影響(C)	低
完全性への影響(I)	低
可用性への影響(A)	なし
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:o:opensuse:opensuse:12.3:::::::*
cpe:2.3:o:opensuse:opensuse:13.1:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:apache:subversion:1.2.0:::::::*
cpe:2.3:a:apache:subversion:1.0.4:::::::*
cpe:2.3:a:apache:subversion:1.6.10:::::::*
cpe:2.3:a:apache:subversion:1.6.19:::::::*
cpe:2.3:a:apache:subversion:1.8.2:::::::*
cpe:2.3:a:apache:subversion:1.0.8:::::::*
cpe:2.3:a:apache:subversion:1.4.5:::::::*
cpe:2.3:a:apache:subversion:1.7.3:::::::*
cpe:2.3:a:apache:subversion:1.0.2:::::::*
cpe:2.3:a:apache:subversion:1.1.2:::::::*
cpe:2.3:a:apache:subversion:1.6.20:::::::*
cpe:2.3:a:apache:subversion:1.7.17:::::::*
cpe:2.3:a:apache:subversion:1.8.0:::::::*
cpe:2.3:a:apache:subversion:1.0.9:::::::*
cpe:2.3:a:apache:subversion:1.4.2:::::::*
cpe:2.3:a:apache:subversion:1.6.2:::::::*
cpe:2.3:a:apache:subversion:1.7.1:::::::*
cpe:2.3:a:apache:subversion:1.7.11:::::::*
cpe:2.3:a:apache:subversion:1.7.16:::::::*
cpe:2.3:a:apache:subversion:1.6.18:::::::*
cpe:2.3:a:apache:subversion:1.6.16:::::::*
cpe:2.3:a:apache:subversion:1.5.5:::::::*
cpe:2.3:a:apache:subversion:1.7.4:::::::*
cpe:2.3:a:apache:subversion:1.6.21:::::::*
cpe:2.3:a:apache:subversion:1.6.5:::::::*
cpe:2.3:a:apache:subversion:1.1.1:::::::*
cpe:2.3:a:apache:subversion:1.7.6:::::::*
cpe:2.3:a:apache:subversion:1.5.3:::::::*
cpe:2.3:a:apache:subversion:1.2.3:::::::*
cpe:2.3:a:apache:subversion:1.4.0:::::::*
cpe:2.3:a:apache:subversion:1.8.1:::::::*
cpe:2.3:a:apache:subversion:1.4.4:::::::*
cpe:2.3:a:apache:subversion:1.5.7:::::::*
cpe:2.3:a:apache:subversion:1.4.6:::::::*
cpe:2.3:a:apache:subversion:1.3.1:::::::*
cpe:2.3:a:apache:subversion:1.8.9:::::::*
cpe:2.3:a:apache:subversion:1.7.9:::::::*
cpe:2.3:a:apache:subversion:1.7.12:::::::*
cpe:2.3:a:apache:subversion:1.6.3:::::::*
cpe:2.3:a:apache:subversion:1.6.8:::::::*
cpe:2.3:a:apache:subversion:1.7.10:::::::*
cpe:2.3:a:apache:subversion:1.8.5:::::::*
cpe:2.3:a:apache:subversion:1.6.13:::::::*
cpe:2.3:a:apache:subversion:1.7.7:::::::*
cpe:2.3:a:apache:subversion:1.0.3:::::::*
cpe:2.3:a:apache:subversion:1.6.0:::::::*
cpe:2.3:a:apache:subversion:1.1.4:::::::*
cpe:2.3:a:apache:subversion:1.5.8:::::::*
cpe:2.3:a:apache:subversion:1.5.2:::::::*
cpe:2.3:a:apache:subversion:1.0.6:::::::*
cpe:2.3:a:apache:subversion:1.6.7:::::::*
cpe:2.3:a:apache:subversion:1.0.1:::::::*
cpe:2.3:a:apache:subversion:1.3.2:::::::*
cpe:2.3:a:apache:subversion:1.6.12:::::::*
cpe:2.3:a:apache:subversion:1.8.6:::::::*
cpe:2.3:a:apache:subversion:1.7.2:::::::*
cpe:2.3:a:apache:subversion:1.0.5:::::::*
cpe:2.3:a:apache:subversion:1.6.1:::::::*
cpe:2.3:a:apache:subversion:1.6.4:::::::*
cpe:2.3:a:apache:subversion:1.7.13:::::::*
cpe:2.3:a:apache:subversion:1.2.1:::::::*
cpe:2.3:a:apache:subversion:1.8.4:::::::*
cpe:2.3:a:apache:subversion:1.6.23:::::::*
cpe:2.3:a:apache:subversion:1.8.3:::::::*
cpe:2.3:a:apache:subversion:1.7.8:::::::*
cpe:2.3:a:apache:subversion:1.4.3:::::::*
cpe:2.3:a:apache:subversion:1.8.7:::::::*
cpe:2.3:a:apache:subversion:1.6.15:::::::*
cpe:2.3:a:apache:subversion:1.5.4:::::::*
cpe:2.3:a:apache:subversion:1.3.0:::::::*
cpe:2.3:a:apache:subversion:1.7.14:::::::*
cpe:2.3:a:apache:subversion:1.6.11:::::::*
cpe:2.3:a:apache:subversion:1.1.3:::::::*
cpe:2.3:a:apache:subversion:1.2.2:::::::*
cpe:2.3:a:apache:subversion:1.7.5:::::::*
cpe:2.3:a:apache:subversion:1.6.14:::::::*
cpe:2.3:a:apache:subversion:1.1.0:::::::*
cpe:2.3:a:apache:subversion:1.5.1:::::::*
cpe:2.3:a:apache:subversion:1.7.15:::::::*
cpe:2.3:a:apache:subversion:1.6.17:::::::*
cpe:2.3:a:apache:subversion:1.5.6:::::::*
cpe:2.3:a:apache:subversion:1.0.7:::::::*
cpe:2.3:a:apache:subversion:1.5.0:::::::*
cpe:2.3:a:apache:subversion:1.0.0:::::::*
cpe:2.3:a:apache:subversion:1.6.6:::::::*
cpe:2.3:a:apache:subversion:1.6.9:::::::*
cpe:2.3:a:apache:subversion:1.4.1:::::::*
cpe:2.3:a:apache:subversion:1.8.8:::::::*
cpe:2.3:a:apache:subversion:1.7.0:::::::*

Configuration3	or higher	or less	more than	less than
cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:::::*

Configuration4		or higher	or less	more than	less than
cpe:2.3:a:apple:xcode:6.1.1:::::::*

Configuration5	or higher	or less	more than	less than
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_eus:6.6.z:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_hpc_node:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*

Related information, measures and tools

No	URL	タグ
1	http://lists.apple.com/archives/security-announce/2015/Mar/msg00003.html	Mailing List Third Party Advisory
2	http://lists.apple.com/archives/security-announce/2015/Mar/msg00003.html	Mailing List Third Party Advisory
3	http://lists.opensuse.org/opensuse-updates/2014-08/msg00038.html	Third Party Advisory
4	http://lists.opensuse.org/opensuse-updates/2014-08/msg00038.html	Third Party Advisory
5	http://rhn.redhat.com/errata/RHSA-2015-0165.html	Third Party Advisory
6	http://rhn.redhat.com/errata/RHSA-2015-0165.html	Third Party Advisory
7	http://rhn.redhat.com/errata/RHSA-2015-0166.html	Third Party Advisory
8	http://rhn.redhat.com/errata/RHSA-2015-0166.html	Third Party Advisory
9	http://secunia.com/advisories/59432
10	http://secunia.com/advisories/59432
11	http://secunia.com/advisories/59584
12	http://secunia.com/advisories/59584
13	http://secunia.com/advisories/60722
14	http://secunia.com/advisories/60722
15	http://subversion.apache.org/security/CVE-2014-3528-advisory.txt	Vendor Advisory
16	http://subversion.apache.org/security/CVE-2014-3528-advisory.txt	Vendor Advisory
17	http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
18	http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
19	http://www.securityfocus.com/bid/68995
20	http://www.securityfocus.com/bid/68995
21	http://www.ubuntu.com/usn/USN-2316-1	Vendor Advisory
22	http://www.ubuntu.com/usn/USN-2316-1	Vendor Advisory
23	https://security.gentoo.org/glsa/201610-05
24	https://security.gentoo.org/glsa/201610-05
25	https://support.apple.com/HT204427	Third Party Advisory
26	https://support.apple.com/HT204427	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-255	証明書・パスワード管理	https://cwe.mitre.org/data/definitions/255.html

JVN Vulnerability Information

Apache Subversion における資格情報を取得される脆弱性

Title	Apache Subversion における資格情報を取得される脆弱性
Summary	Apache Subversion は、キャッシュされた資格情報の格納に URL および認証レルムの MD5 ハッシュを使用するため、資格情報を取得される脆弱性が存在します。
Possible impacts	リモートサーバにより、巧妙に細工された認証レルムを介して、資格情報を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Aug. 14, 2014, midnight
Registration Date	Aug. 21, 2014, 4:30 p.m.
Last Update	Oct. 30, 2015, 4:47 p.m.

Affected System

Apache Software Foundation

Apache Subversion 1.7.18 未満の 1.0.0 から 1.7.x

Apache Subversion 1.8.10 未満の 1.8.x

アップル

Xcode 6.2 未満 (OS X Mavericks v10.9.4 以降)

Canonical

Ubuntu 12.04 LTS

Ubuntu 14.04 LTS

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Apache Software Foundation
1	CVE-2014-3528-advisory	http://subversion.apache.org/security/CVE-2014-3528-advisory.txt
Common Vulnerabilities and Exposures (CVE)
2	CVE-2014-3528	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3528
National Vulnerability Database (NVD)
3	CVE-2014-3528	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3528

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-255	https://jvndb.jvn.jp/ja/cwe/CWE-255.html

ベンダー情報

No	Name	URL
Apple Mailing Lists
1	APPLE-SA-2015-03-09-4 Xcode 6.2	http://lists.apple.com/archives/security-announce/2015/Mar/msg00003.html
Apple Security Updates
2	HT204427	https://support.apple.com/en-us/HT204427
Apple セキュリティアップデート
3	HT204427	http://support.apple.com/ja-jp/HT204427
Oracle Technology Network
4	Oracle Solaris Third Party Bulletin - October 2015	http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
Red Hat Security Advisory
5	RHSA-2015:0165	http://rhn.redhat.com/errata/RHSA-2015-0165.html
6	RHSA-2015:0166	http://rhn.redhat.com/errata/RHSA-2015-0166.html
Ubuntu Security Notice
7	USN-2316-1	http://www.ubuntu.com/usn/USN-2316-1

その他

No	Name	URL
JVN
1	JVNVU#90171154	http://jvn.jp/vu/JVNVU90171154/index.html

Change Log

No	Changed Details	Date of change
0	[2014年08月21日] 掲載 [2015年03月13日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：アップル (HT204427) を追加ベンダ情報：アップル (APPLE-SA-2015-03-09-4 Xcode 6.2) を追加参考情報：JVN (JVNVU#90171154) を追加 [2015年06月15日] ベンダ情報：レッドハット (RHSA-2015:0165) を追加　ベンダ情報：レッドハット (RHSA-2015:0166) を追加 [2015年10月30日] ベンダ情報：オラクル (Oracle Solaris Third Party Bulletin - October 2015) を追加	Feb. 17, 2018, 10:37 a.m.

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:apache:subversion:1.2.0:::::::*
cpe:2.3:a:apache:subversion:1.0.4:::::::*
cpe:2.3:a:apache:subversion:1.6.10:::::::*
cpe:2.3:a:apache:subversion:1.6.19:::::::*
cpe:2.3:a:apache:subversion:1.8.2:::::::*
cpe:2.3:a:apache:subversion:1.0.8:::::::*
cpe:2.3:a:apache:subversion:1.4.5:::::::*
cpe:2.3:a:apache:subversion:1.7.3:::::::*
cpe:2.3:a:apache:subversion:1.0.2:::::::*
cpe:2.3:a:apache:subversion:1.1.2:::::::*
cpe:2.3:a:apache:subversion:1.6.20:::::::*
cpe:2.3:a:apache:subversion:1.7.17:::::::*
cpe:2.3:a:apache:subversion:1.8.0:::::::*
cpe:2.3:a:apache:subversion:1.0.9:::::::*
cpe:2.3:a:apache:subversion:1.4.2:::::::*
cpe:2.3:a:apache:subversion:1.6.2:::::::*
cpe:2.3:a:apache:subversion:1.7.1:::::::*
cpe:2.3:a:apache:subversion:1.7.11:::::::*
cpe:2.3:a:apache:subversion:1.7.16:::::::*
cpe:2.3:a:apache:subversion:1.6.18:::::::*
cpe:2.3:a:apache:subversion:1.6.16:::::::*
cpe:2.3:a:apache:subversion:1.5.5:::::::*
cpe:2.3:a:apache:subversion:1.7.4:::::::*
cpe:2.3:a:apache:subversion:1.6.21:::::::*
cpe:2.3:a:apache:subversion:1.6.5:::::::*
cpe:2.3:a:apache:subversion:1.1.1:::::::*
cpe:2.3:a:apache:subversion:1.7.6:::::::*
cpe:2.3:a:apache:subversion:1.5.3:::::::*
cpe:2.3:a:apache:subversion:1.2.3:::::::*
cpe:2.3:a:apache:subversion:1.4.0:::::::*
cpe:2.3:a:apache:subversion:1.8.1:::::::*
cpe:2.3:a:apache:subversion:1.4.4:::::::*
cpe:2.3:a:apache:subversion:1.5.7:::::::*
cpe:2.3:a:apache:subversion:1.4.6:::::::*
cpe:2.3:a:apache:subversion:1.3.1:::::::*
cpe:2.3:a:apache:subversion:1.8.9:::::::*
cpe:2.3:a:apache:subversion:1.7.9:::::::*
cpe:2.3:a:apache:subversion:1.7.12:::::::*
cpe:2.3:a:apache:subversion:1.6.3:::::::*
cpe:2.3:a:apache:subversion:1.6.8:::::::*
cpe:2.3:a:apache:subversion:1.7.10:::::::*
cpe:2.3:a:apache:subversion:1.8.5:::::::*
cpe:2.3:a:apache:subversion:1.6.13:::::::*
cpe:2.3:a:apache:subversion:1.7.7:::::::*
cpe:2.3:a:apache:subversion:1.0.3:::::::*
cpe:2.3:a:apache:subversion:1.6.0:::::::*
cpe:2.3:a:apache:subversion:1.1.4:::::::*
cpe:2.3:a:apache:subversion:1.5.8:::::::*
cpe:2.3:a:apache:subversion:1.5.2:::::::*
cpe:2.3:a:apache:subversion:1.0.6:::::::*
cpe:2.3:a:apache:subversion:1.6.7:::::::*
cpe:2.3:a:apache:subversion:1.0.1:::::::*
cpe:2.3:a:apache:subversion:1.3.2:::::::*
cpe:2.3:a:apache:subversion:1.6.12:::::::*
cpe:2.3:a:apache:subversion:1.8.6:::::::*
cpe:2.3:a:apache:subversion:1.7.2:::::::*
cpe:2.3:a:apache:subversion:1.0.5:::::::*
cpe:2.3:a:apache:subversion:1.6.1:::::::*
cpe:2.3:a:apache:subversion:1.6.4:::::::*
cpe:2.3:a:apache:subversion:1.7.13:::::::*
cpe:2.3:a:apache:subversion:1.2.1:::::::*
cpe:2.3:a:apache:subversion:1.8.4:::::::*
cpe:2.3:a:apache:subversion:1.6.23:::::::*
cpe:2.3:a:apache:subversion:1.8.3:::::::*
cpe:2.3:a:apache:subversion:1.7.8:::::::*
cpe:2.3:a:apache:subversion:1.4.3:::::::*
cpe:2.3:a:apache:subversion:1.8.7:::::::*
cpe:2.3:a:apache:subversion:1.6.15:::::::*
cpe:2.3:a:apache:subversion:1.5.4:::::::*
cpe:2.3:a:apache:subversion:1.3.0:::::::*
cpe:2.3:a:apache:subversion:1.7.14:::::::*
cpe:2.3:a:apache:subversion:1.6.11:::::::*
cpe:2.3:a:apache:subversion:1.1.3:::::::*
cpe:2.3:a:apache:subversion:1.2.2:::::::*
cpe:2.3:a:apache:subversion:1.7.5:::::::*
cpe:2.3:a:apache:subversion:1.6.14:::::::*
cpe:2.3:a:apache:subversion:1.1.0:::::::*
cpe:2.3:a:apache:subversion:1.5.1:::::::*
cpe:2.3:a:apache:subversion:1.7.15:::::::*
cpe:2.3:a:apache:subversion:1.6.17:::::::*
cpe:2.3:a:apache:subversion:1.5.6:::::::*
cpe:2.3:a:apache:subversion:1.0.7:::::::*
cpe:2.3:a:apache:subversion:1.5.0:::::::*
cpe:2.3:a:apache:subversion:1.0.0:::::::*
cpe:2.3:a:apache:subversion:1.6.6:::::::*
cpe:2.3:a:apache:subversion:1.6.9:::::::*
cpe:2.3:a:apache:subversion:1.4.1:::::::*
cpe:2.3:a:apache:subversion:1.8.8:::::::*
cpe:2.3:a:apache:subversion:1.7.0:::::::*

Configuration5	or higher	or less	more than	less than
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_eus:6.6.z:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_hpc_node:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*