NVD

Id
18440  
Name
CVE-2016-2167  
Description
The canonicalize_username function in svnserve/cyrus_auth.c in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4, when Cyrus SASL authentication is used, allows remote attackers to authenticate and bypass intended access restrictions via a realm string that is a prefix of an expected repository realm string.  
Reject
 
CVSS Version
2  
CVSS Score
4.9  
Severity
Medium  
CVSS Base Score
4.9  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
6.8  
CVSS Vector
(AV:N/AC:M/Au:S/C:P/I:P/A:N)  
Pub Date
2017-01-19  
Published
2016-05-05  
Modified Date
2016-11-30  
Seq
2016-2167  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
102432 18440 CVE-2016-2167 FEDORA-2016-20cc04ac50  View
102433 18440 CVE-2016-2167 openSUSE-SU-2016:1263  View
102434 18440 CVE-2016-2167 openSUSE-SU-2016:1264  View
102435 18440 CVE-2016-2167 [subversion-announce] 20160428 [ANNOUNCE][SECURITY] Apache Subversion 1.9.4 released  View
102436 18440 CVE-2016-2167 [subversion-announce] 20160428 [ANNOUNCE][SECURITY] Apache Subversion 1.8.16 released  View
102437 18440 CVE-2016-2167 http://subversion.apache.org/security/CVE-2016-2167-advisory.txt  View
102438 18440 CVE-2016-2167 DSA-3561  View
102439 18440 CVE-2016-2167 89417  View
102440 18440 CVE-2016-2167 1035706  View
102441 18440 CVE-2016-2167 SSA:2016-121-01  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
1697 JVNDB-2016-002470 Apache Subversion の svnserve/cyrus_auth.c の canonicalize_username 関数における認証に関する脆弱性 Apache Subversion の svnserve/cyrus_auth.c の canonicalize_username 関数は、Cyrus SASL 認証が使用されている場合、認証され、アクセス制限を回避される脆弱性が存在します。 CVE-2016-2167 88673 CVE-2016-2167 18440 4.9 6.8 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-002470.html 2016-04-28 2016-05-10 View