[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20161231154054.abrg2lwgdfj3354p@eldamar.local>
Date: Sat, 31 Dec 2016 16:40:54 +0100
From: Salvatore Bonaccorso <carnil@...ian.org>
To: OSS Security Mailinglist <oss-security@...ts.openwall.com>
Cc: daved@...siol.usyd.edu.au, Jean-Francois Dockes <jf@...kes.org>,
Willi Mann <willi@...ian.org>, security@...ian.org
Subject: CVE Request: UnRTF: stack-based buffer overflows in cmd_* functions
Hi
As reported by "Skylake" in the Debian bugtracker[1], UnRTF is prone
to stack-based buffer overflows in various cmd_* functions.
> I've found a Stack-based buffer overflow in unrtf 0.21.9, which
> affects three functions including: cmd_expand, cmd_emboss and
> cmd_engrave.
>
> # convert.c
>
> static int
> cmd_expand (Word *w, int align, char has_param, int param) {
> char str[10];
> if (has_param) {
> sprintf(str, "%d", param/4); // Overflow, 9-digit negative value triggers the bug
> if (!param)
> attr_pop(ATTR_EXPAND);
> else
> attr_push(ATTR_EXPAND, str);
> }
> return FALSE;
> }
>
> Apparently writing a negative integer to the buffer can trigger the
> overflow (Minus sign needs an extra byte).
>
> * How to trigger the bug *
>
> $ echo "\expnd-400000000" > poc
> $ unrtf poc
A preliminary patch can be found in the Debian bugtracker, but it is
not yet finalized.
Could you assign (a?) CVE as needed? Does one CVE suffice here, since
same class of issue in various cmd_* functions from one reporter?
Whilest, at least in Debian, unrtf is compiled with FORTIFY_SOURCE=2
and the buffer overflows are detected, at least if any exposed
application uses unrtf to process untrusted input, this might lead to
a denial-of-service.
[1] https://bugs.debian.org/849705
Regards,
Salvatore
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
