Mailinglist Archive: opensuse-bugs (4227 mails)

< Previous Next >
[Bug 1017682] New: VUL-0: CVE-2016-10091: UnRTF: stack-based buffer overflows in cmd_* functions
  • From: bugzilla_noreply@xxxxxxxxxx
  • Date: Sun, 01 Jan 2017 00:15:01 +0000
  • Message-id: <bug-1017682-21960@http.bugzilla.opensuse.org/>
http://bugzilla.opensuse.org/show_bug.cgi?id=1017682


Bug ID: 1017682
Summary: VUL-0: CVE-2016-10091: UnRTF: stack-based buffer
overflows in cmd_* functions
Classification: openSUSE
Product: openSUSE Distribution
Version: Leap 42.2
Hardware: Other
OS: Other
Status: NEW
Severity: Normal
Priority: P5 - None
Component: KDE3
Assignee: anixx@xxxxxxxxxxxx
Reporter: mikhail.kasimov@xxxxxxxxx
QA Contact: qa-bugs@xxxxxxx
Found By: ---
Blocker: ---

Ref: http://seclists.org/oss-sec/2016/q4/786
===============================================
Hi

As reported by "Skylake" in the Debian bugtracker[1], UnRTF is prone
to stack-based buffer overflows in various cmd_* functions.

I've found a Stack-based buffer overflow in unrtf 0.21.9, which
affects three functions including: cmd_expand, cmd_emboss and
cmd_engrave.

# convert.c

static int
cmd_expand (Word *w, int align, char has_param, int param) {
char str[10];
if (has_param) {
sprintf(str, "%d", param/4); // Overflow, 9-digit negative value triggers
the bug
if (!param)
attr_pop(ATTR_EXPAND);
else
attr_push(ATTR_EXPAND, str);
}
return FALSE;
}

Apparently writing a negative integer to the buffer can trigger the
overflow (Minus sign needs an extra byte).

* How to trigger the bug *

$ echo "\expnd-400000000" > poc
$ unrtf poc


A preliminary patch can be found in the Debian bugtracker, but it is
not yet finalized.

Could you assign (a?) CVE as needed? Does one CVE suffice here, since
same class of issue in various cmd_* functions from one reporter?
Whilest, at least in Debian, unrtf is compiled with FORTIFY_SOURCE=2
and the buffer overflows are detected, at least if any exposed
application uses unrtf to process untrusted input, this might lead to
a denial-of-service.

[1] https://bugs.debian.org/849705

Regards,
Salvatore
===============================================

https://software.opensuse.org/package/unrtf

TW: KDE:KDE3: 0.21.5
42.2: KDE:Extra: 0.21.5 and KDE:KDE3: 0.21.8
42.1: KDE:Extra: 0.21.5 and KDE:KDE3: 0.21.8
13.2: KDE:Extra: 0.21.5 and KDE:KDE3: 0.21.8

--
You are receiving this mail because:
You are on the CC list for the bug.
< Previous Next >
List Navigation