CVE-2014-3528 Weak cryptography in n/a
Attackers can steal cached credentials by crafting authentication realms due to weak MD5 hashing, affecting Subversion users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2014-3528?
CVE-2014-3528 is a medium-severity vulnerability in Apple Xcode, published on 19 Aug 2014. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm.
Weakness: CWE-255
Which versions are affected by CVE-2014-3528?
It affects 9 products.
Products include Apache Subversion, Apple Xcode, Canonical Ubuntu Linux, Opensuse Opensuse, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Hpc Node and 3 more.
How do I fix CVE-2014-3528?
Upgrade to a fixed version.
Is CVE-2014-3528 being exploited?
There is no known exploitation of CVE-2014-3528 in the wild and no public exploit code.
Other vulnerabilities in Apple Xcode
- CVE-2017-9800 A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha
- CVE-2013-4246 Denial of service in n/a
- CVE-2015-5259 Integer overflow in n/a
- CVE-2024-45720 Apache Subversion: Command line argument injection on Windows platforms
- CVE-2015-0202 Denial of service in n/a
Sources
Also known as DEBIAN-CVE-2014-3528, GHSA-vxf6-xw9g-6cfc, MGASA-2014-0338, UBUNTU-CVE-2014-3528.