Poem: There once was some open src code, that claimed it would lighten your load, it took a little fuzzing, and i came out buzzing, as it crashed in svn:// mode. Introduction (from Subversion.tigris.org): The goal of the Subversion project is to build a version control system that is a compelling replacement for CVS in the open source community. Brief Overview: http://subversion.tigris.org/security/CAN-2004-0413-advisory.txt Process Overview: Ther is really never much said about finding bugs. In some cases, there really is no process execpt for "grep -r scanf *|grep %s". However, this little rant should show how easy it is to find a bug. In anything. It started one day when FelineMenace began to use Subversion for version management of some stuff we were doing. I happened to find that svnserve was running, i knew SVN would have to have an equivalent of CVS pserver. Anyway, i know i'm not the only one, but when i see that a something is listening, as svnserve did (3690?), i get excited. How i found the bug: 1. I installed Subversion client on Linux (redhat 7.1) and svnserve on Windows (XP). This may sound strange, but it's 500% easier to set up servers in windows then it is in linux. 2. I set up a repository called SMUDGE (very appropriate) and ran Ethereal on the Linux Machine. 3. I just did some stuff like co the repository, and then went back to ethereal and found the session. 4. I have a slew of scripts to do neet stuff for me, i broke out ascii parse.py which searched through the ethereal dumps for text, and sets them as variables for my old fuzzer, SMUDGE. 5. I attached OllyDbg to svnserve. 6. I ran the SMUDGE script and nothing happened. I had failed to take into account the svnserve protocol. It's based on a sort of markup of blocks like "( i am a block ( here is my child ) )". 7. I took the protocol into account, and OllyDbg flashed, and the rest is history. Conclusion: I'm not sure how much of that makes sense, but it may be a good reference for people who would like to find bugs. If you want SMUDGE: http://felinemenace.org/~nd/SMUDGE If you want pictures of the overflow http://felinemenace.org/~nd/SMUDGE/svn1/svn1.png http://felinemenace.org/~nd/SMUDGE/svn1/svn2.png If you want 0day: http://felinemenace.org/~nd/UBC.html -- http://felinemenace.org/~nd
