[VulnWatch] [FMADV] Subversion <= 1.04 Heap Overflow

From: ned (nd_at_felinemenace.org)
Date: 06/12/04

  • Next message: Thomas Ryan: "[VulnWatch] VP-ASP Shopping Cart Multiple Vulnerabilities" 
    Date: Fri, 11 Jun 2004 19:09:24 -0700 (PDT)
To: bugtraq@securityfocus.com, <vuln-dev@securityfocus.com>

    Poem:
    There once was some open src code,
    that claimed it would lighten your load,
    it took a little fuzzing,
    and i came out buzzing,
    as it crashed in svn:// mode.

    Introduction (from Subversion.tigris.org):
    The goal of the Subversion project is to build a version control system
    that is a compelling replacement for CVS in the open source community.

    Brief Overview:
    http://subversion.tigris.org/security/CAN-2004-0413-advisory.txt

    Process Overview:
    Ther is really never much said about finding bugs. In some cases, there
    really is no process execpt for "grep -r scanf *|grep %s". However, this
    little rant should show how easy it is to find a bug. In anything.

    It started one day when FelineMenace began to use Subversion for version
    management of some stuff we were doing. I happened to find that svnserve
    was running, i knew SVN would have to have an equivalent of CVS pserver.
    Anyway, i know i'm not the only one, but when i see that a something is
    listening, as svnserve did (3690?), i get excited.

    How i found the bug:
    1. I installed Subversion client on Linux (redhat 7.1) and svnserve on
    Windows (XP). This may sound strange, but it's 500% easier to set up
    servers in windows then it is in linux.

    2. I set up a repository called SMUDGE (very appropriate) and ran Ethereal
    on the Linux Machine.

    3. I just did some stuff like co the repository, and then went back to
    ethereal and found the session.

    4. I have a slew of scripts to do neet stuff for me, i broke out ascii
    parse.py which searched through the ethereal dumps for text, and sets them
    as variables for my old fuzzer, SMUDGE.

    5. I attached OllyDbg to svnserve.

    6. I ran the SMUDGE script and nothing happened.

    I had failed to take into account the svnserve protocol. It's based on a
    sort of markup of blocks like "( i am a block ( here is my child ) )".

    7. I took the protocol into account, and OllyDbg flashed, and the rest is
    history.

    Conclusion:
    I'm not sure how much of that makes sense, but it may be a good reference
    for people who would like to find bugs.

    If you want SMUDGE:
    http://felinemenace.org/~nd/SMUDGE

    If you want pictures of the overflow
    http://felinemenace.org/~nd/SMUDGE/svn1/svn1.png
    http://felinemenace.org/~nd/SMUDGE/svn1/svn2.png

    If you want 0day:
    http://felinemenace.org/~nd/UBC.html

    -- http://felinemenace.org/~nd

  • Next message: Thomas Ryan: "[VulnWatch] VP-ASP Shopping Cart Multiple Vulnerabilities"

    Relevant Pages

    • [FMADV] Subversion <= 1.04 Heap Overflow
      ... There once was some open src code, ... Ther is really never much said about finding bugs. ... listening, as svnserve did, i get excited. ... I set up a repository called SMUDGE and ran Ethereal ...
      (Bugtraq)
    • [Full-Disclosure] [FMADV] Subversion <= 1.04 Heap Overflow
      ... There once was some open src code, ... Ther is really never much said about finding bugs. ... listening, as svnserve did, i get excited. ... I set up a repository called SMUDGE and ran Ethereal ...
      (Full-Disclosure)
    • [FMADV] Subversion <= 1.04 Heap Overflow
      ... There once was some open src code, ... Ther is really never much said about finding bugs. ... listening, as svnserve did, i get excited. ... I set up a repository called SMUDGE and ran Ethereal ...
      (Full-Disclosure)
    • [VulnWatch] [FMADV] Subversion <= 1.04 Heap Overflow
      ... There once was some open src code, ... Ther is really never much said about finding bugs. ... listening, as svnserve did, i get excited. ... I set up a repository called SMUDGE and ran Ethereal ...
      (Full-Disclosure)