Vulnerability record · CVE-2004-0397 · published 7 July 2004
CVE-2004-0397: Subversion apr_time_t conversion stack buffer overflow
Subversion · Subversion
Subversion 1.0.2 and earlier contains a stack-based buffer overflow in the apr_time_t data conversion routine. A remote attacker can trigger it through a DAV2 REPORT query or a get-dated-rev svn-protocol command, making it a serious pre-authentication risk for exposed Subversion servers.
Description
Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1.0.2 and earlier allows remote attackers to execute arbitrary code via a (1) DAV2 REPORT query or (2) get-dated-rev svn-protocol command.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityRemote, unauthenticated code execution with public exploit references and very high EPSS, though not listed in KEV.
What it is
Subversion 1.0.2 and earlier contains a stack-based buffer overflow in the apr_time_t data conversion routine. A remote attacker can trigger it through a DAV2 REPORT query or a get-dated-rev svn-protocol command, making it a serious pre-authentication risk for exposed Subversion servers.
Impact
Successful exploitation allows remote code execution with the privileges of the Subversion server process. That gives an attacker full control of the service and potentially the underlying host.
Attack surface
Reachable over the network via the Subversion HTTP/DAV or svn protocol interfaces, as reflected by the AV:N/AC:L/Au:N vector. No authentication or user interaction is required per the CVSS vector.
Exploitation
CISA KEV does not list this CVE, but EPSS is very high (0.7525, 99.5th percentile) and a SecurityFocus reference is tagged Exploit, indicating public exploit material exists.
What to do
- Upgrade Subversion to a version later than 1.0.2, which contains the fix for the apr_time_t conversion overflow.
- If immediate upgrade is not possible, restrict network access to Subversion DAV and svn protocol endpoints to trusted clients only.
- Apply vendor patches referenced in the Subversion advisory and distribution advisories (Gentoo, Fedora).
- Run the Subversion server with least privilege and isolate it from sensitive internal networks.
- Monitor for and block malformed DAV2 REPORT or get-dated-rev requests at the perimeter.
Detection
- Inspect Subversion server logs for malformed or unusually long DAV2 REPORT and get-dated-rev requests.
- Deploy network signatures for oversized apr_time_t conversion payloads on Subversion ports.
- Monitor for unexpected process crashes or restarts of the Subversion service.
- Watch for post-exploitation behavior such as new processes or outbound connections from the Subversion host.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2004-0397 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2004-0397), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
