full-disclosure - [FMADV] Subversion <= 1.04 Heap Overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.44.0406111842070.27597-100000@scratch>
From: nd at felinemenace.org (ned)
Subject: [FMADV] Subversion <= 1.04 Heap Overflow

Poem:
There once was some open src code,
that claimed it would lighten your load,
it took a little fuzzing,
and i came out buzzing,
as it crashed in svn:// mode.

Introduction (from Subversion.tigris.org):
The goal of the Subversion project is to build a version control system 
that is a compelling replacement for CVS in the open source community.

Brief Overview:
http://subversion.tigris.org/security/CAN-2004-0413-advisory.txt

Process Overview:
Ther is really never much said about finding bugs. In some cases, there 
really is no process execpt for "grep -r scanf *|grep %s". However, this 
little rant should show how easy it is to find a bug. In anything.

It started one day when FelineMenace began to use Subversion for version 
management of some stuff we were doing. I happened to find that svnserve 
was running, i knew SVN would have to have an equivalent of CVS pserver. 
Anyway, i know i'm not the only one, but when i see that a something is 
listening, as svnserve did (3690?), i get excited.

How i found the bug:
1. I installed Subversion client on Linux (redhat 7.1) and svnserve on 
Windows (XP). This may sound strange, but it's 500% easier to set up 
servers in windows then it is in linux.

2. I set up a repository called SMUDGE (very appropriate) and ran Ethereal 
on the Linux Machine.

3. I just did some stuff like co the repository, and then went back to 
ethereal and found the session.

4. I have a slew of scripts to do neet stuff for me, i broke out ascii 
parse.py which searched through the ethereal dumps for text, and sets them 
as variables for my old fuzzer, SMUDGE.

5. I attached OllyDbg to svnserve.

6. I ran the SMUDGE script and nothing happened.

I had failed to take into account the svnserve protocol. It's based on a 
sort of markup of blocks like "( i am a block ( here is my child ) )".

7. I took the protocol into account, and OllyDbg flashed, and the rest is 
history.

Conclusion:
I'm not sure how much of that makes sense, but it may be a good reference 
for people who would like to find bugs.

If you want SMUDGE:
http://felinemenace.org/~nd/SMUDGE

If you want pictures of the overflow
http://felinemenace.org/~nd/SMUDGE/svn1/svn1.png
http://felinemenace.org/~nd/SMUDGE/svn1/svn2.png

If you want 0day:
http://felinemenace.org/~nd/UBC.html

-- http://felinemenace.org/~nd