Subversion 1.4.5 was released today. You can download the updated CollabNet Subversion binaries immediately.
Subversion 1.4.5 contains a fix for a security exploit on Windows
clients. This exploit was discovered and reported by researchers at the
Colorado Research Institute for Security and Privacy.
The only change from Subversion 1.4.4 is the patch for this security
exploit. Since the exploit only affects Windows clients, we decided to
only release CollabNet Subversion 1.4.5 packages for Windows. There is
no point for someone who is already running 1.4.4 on any other
operating system to update to 1.4.5.
I am not going to give a lot of details about the exploit, you can
find more information at various security reporting sites, such as CVE.
I will say that it was a legitimate exposure that made it possible for
the Subversion client to write files outside the normal working copy.
That being said, there are a couple of points to make:
- Creating the exploit requires commit access to the repository.
If you can trust the people who have write access to the repository,
then you do not have too much to be concerned about. The keyword in
that sentence is "trust". If you are checking out from a repository you
cannot completely trust, such as on a public hosting service, then be
careful and update to 1.4.5 first.
- While the exploit itself is pretty easy to produce, it is also pretty difficult to use it in a way that would cause harm.
- You can only create the exploit from a non-Windows platform.
- There is nothing terribly secretive about the exploit. If you send
commit emails, or even just browse your repository using svn ls, this
exploit would stand out as not normal.
If you are running a Subversion client on Windows, this would
include the command line client as well as any graphical client such as
TortoiseSVN or Subclipse,
then you should definitely go ahead and install this version of
Subversion. I would recommend that users of earlier versions such as
1.3.2 or 1.2.3 also install this update immediately. The Subversion
1.4.5 client can talk to any 1.x version of the server, so there is no
reason not to update your client (for compatibility: if you have the command line and a GUI client, update them both).
Subversion servers are not affected by this exploit. That being
said, a Windows server that uses the Subversion client in scripts would
still be vulnerable and should be updated to 1.4.5.
http://blogs.open.collab.net/svn/2007/08/subversion-145-.html