xlreader version 0.9.0 is susceptible to a buffer overflow condition in the book_format_sql() function.
24823c2b3a25e369e195d3e131c64fa7dc46b58fb25a2375c5797b7a36fdb1c9
From djb@cr.yp.to Wed Dec 15 14:20:02 2004
Date: 15 Dec 2004 08:06:57 -0000
From: D. J. Bernstein <djb@cr.yp.to>
To: securesoftware@list.cr.yp.to, david@giffin.org
Subject: [remote] [control] xlreader 0.9.0 overflows insert_start buffer
Tom Palarz and Kris Kubicki, two students in my Fall 2004 UNIX Security
Holes course, have discovered a remotely exploitable security hole in
xlreader, a program to read Excel files. I'm publishing this notice, but
all the discovery credits should be assigned to Palarz and Kubicki.
You are at risk if you take an Excel document from an email message (or
a web page or any other source that could be controlled by an attacker)
and feed that document through xlreader -s. Whoever provides that
document then has complete control over your account: he can read and
modify your files, watch the programs you're running, etc.
The xlreader documentation does not tell users to avoid taking input
from the network. In fact, the xlreader web page says ``I get all my
email on a UNIX box. And frequently people will send Excel attachments.''
Proof of concept: On an x86 computer running FreeBSD 4.10, type
wget http://umn.dl.sourceforge.net/sourceforge/xlreader/xlreader-0.9.0.tgz
gunzip < xlreader-0.9.0.tgz | tar -xf -
cd xlreader-0.9.0
make
to download and compile the xlreader program, version 0.9.0 (current).
Then save the Excel document attached to this message as 1.xls, and type
xlreader -s 1.xls > 1.sql
with the unauthorized result that a file named EXPLOITED is created in
the current directory. (I tested this with a 540-byte environment, as
reported by printenv | wc -c.)
Here's the bug: In format.c, book_format_sql() uses strcat() to append
strings to the 4096-byte insert_start[] array.
---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago
[ Part 2, Application/EXCEL 39KB. ]
[ Unable to print this part. ]