James Clawson discovered that websvn, a web viewer for Subversion repositories, would follow symlinks in a repository when presenting a file for download. An attacker with repository write access could thereby access any file on disk readable by the user the webserver runs as.

For the stable distribution (wheezy), this problem has been fixed in version 2.3.3-1.1+deb7u1. For the unstable distribution (sid), this problem has been fixed in version 2.3.3-1.2. We recommend that you upgrade your websvn packages.

WebSVN is a set of PHP scripts that provides remote access to Subversion repositories. It supports several repositories, can be customized, supports Apache MultiViews, and can provide RSS feeds.

websvn on Debian Linux

This check tests the installed software version using the apt package manager.

• http://www.debian.org/security/2015/dsa-3137.html

---

Updated on 2015-03-25