A buffer overflow in the ReadFontTbl() function of rtf2latex2e version 1.0fc2 allows for arbitrary code execution.
a6dd3ec378efccdbef11463abc8a1ace07a2f0034a0ce0d0aa977e7ea0f512cd
From djb@cr.yp.to Wed Dec 15 14:20:26 2004
Date: 15 Dec 2004 08:12:17 -0000
From: D. J. Bernstein <djb@cr.yp.to>
To: securesoftware@list.cr.yp.to, prahl@users.sourceforge.net
Subject: [remote] [control] rtf2latex2e 1.0fc2 ReadFontTbl overflows buffer
Limin Wang, a student in my Fall 2004 UNIX Security Holes course, has
discovered a remotely exploitable security hole in rtf2latex2e. I'm
publishing this notice, but all the discovery credits should be assigned
to Wang.
You are at risk if you take an RTF document from an email message (or a
web page or any other source that could be controlled by an attacker)
and feed it through rtf2latex2e. (The rtf2latex2e documentation does not
tell users to avoid taking input from the network.) Whoever provides
that document then has complete control over your account: she can read
and modify your files, watch the programs you're running, etc.
Proof of concept: On an x86 computer running FreeBSD 4.10, type
wget http://umn.dl.sourceforge.net/sourceforge/rtf2latex2e/rtf2latex2eUnix1.tar.gz
gunzip < rtf2latex2eUnix1.tar.gz | tar -xf -
cd rtf2latex2eUnix-1.0fc1
cd Unix
./configure i386-unknown-freebsd4.10
make
to download and compile the rtf2latex2e program, version 1.0fc2
(current). Then save the file 5.rtf attached to this message, and type
env RTF2LATEX2E_DIR=`cd ..;pwd` ../rtf2latex2e.bin 5.rtf
with the unauthorized result that all files are removed from the current
directory. (I tested this with a 552-byte environment, as reported by
printenv | wc -c.)
Here's the bug: In reader.c, ReadFontTbl() reads any number of bytes
into a 1024-byte buf[] array.
---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago
[ Part 2, Application/RTF 1.2KB. ]
[ Unable to print this part. ]