The Subversion development team has released version 1.0.3. This is a security bugfix release and the team suggests all Subversion users upgrade... now!

"Subversion versions up to and including 1.0.2 have a buffer overflow in the date parsing code.

Both client and server are vulnerable. The server is vulnerable over both httpd/DAV and svnserve (that is, over http://, https://, svn://, svn+ssh:// and other tunneled svn+*:// methods).

Additionally, clients with shared working copies, or permissions that allow files in the administrative area of the working copy to be written by other users, are potentially exploitable.

Severity:
=========

Severity ranges from "Denial of Service" to, potentially, "Arbitrary Code Execution", depending upon how skilled the attacker is and the ABI specifics of your platform.

The server vulnerabilities can be triggered without write/commit access to the repository. So repositories with anonymous/public read access are vulnerable.

Workarounds:
============

There are no workarounds except to disallow public access. Even then you'd still be vulnerable to attack by someone who still has access (perhaps you trust those people, though).

Recommendations:
================

We recommend all users upgrade to 1.0.3."

Subversion