[FMADV] Subversion <= 1.04 Heap Overflow
Poem:
There once was some open src code,
that claimed it would lighten your load,
it took a little fuzzing,
and i came out buzzing,
as it crashed in svn:// mode.
Introduction (from Subversion.tigris.org):
The goal of the Subversion project is to build a version control system
that is a compelling replacement for CVS in the open source community.
Brief Overview:
http://subversion.tigris.org/security/CAN-2004-0413-advisory.txt
Process Overview:
Ther is really never much said about finding bugs. In some cases, there
really is no process execpt for "grep -r scanf *|grep %s". However, this
little rant should show how easy it is to find a bug. In anything.
It started one day when FelineMenace began to use Subversion for version
management of some stuff we were doing. I happened to find that svnserve
was running, i knew SVN would have to have an equivalent of CVS pserver.
Anyway, i know i'm not the only one, but when i see that a something is
listening, as svnserve did (3690?), i get excited.
How i found the bug:
1. I installed Subversion client on Linux (redhat 7.1) and svnserve on
Windows (XP). This may sound strange, but it's 500% easier to set up
servers in windows then it is in linux.
2. I set up a repository called SMUDGE (very appropriate) and ran Ethereal
on the Linux Machine.
3. I just did some stuff like co the repository, and then went back to
ethereal and found the session.
4. I have a slew of scripts to do neet stuff for me, i broke out ascii
parse.py which searched through the ethereal dumps for text, and sets them
as variables for my old fuzzer, SMUDGE.
5. I attached OllyDbg to svnserve.
6. I ran the SMUDGE script and nothing happened.
I had failed to take into account the svnserve protocol. It's based on a
sort of markup of blocks like "( i am a block ( here is my child ) )".
7. I took the protocol into account, and OllyDbg flashed, and the rest is
history.
Conclusion:
I'm not sure how much of that makes sense, but it may be a good reference
for people who would like to find bugs.
If you want SMUDGE:
http://felinemenace.org/~nd/SMUDGE
If you want pictures of the overflow
http://felinemenace.org/~nd/SMUDGE/svn1/svn1.png
http://felinemenace.org/~nd/SMUDGE/svn1/svn2.png
If you want 0day:
http://felinemenace.org/~nd/UBC.html
-- http://felinemenace.org/~nd