From idlabs-advisories@idefense.com Fri Jul 9 22:37:24 2004 From: idlabs-advisories@idefense.com To: idlabs-advisories@idefense.com Date: Fri, 9 Jul 2004 10:39:48 -0400 Reply-To: customerservice@idefense.com Subject: [Full-Disclosure] iDEFENSE Security Advisory 07.09.04: wvWare Library Buffer Overflow Vulnerability wvWare Library Buffer Overflow Vulnerability iDEFENSE Security Advisory 07.09.04 www.idefense.com/application/poi/display?id=115&type=vulnerabilities July 09, 2004 I. BACKGROUND Caolán McNamara and Dom Lachowicz's wvWare is a library used to load and parse Microsoft Word files on unix-based systems. wvWare is used in some third-party programs to view and convert Microsoft Word documents to other formats. II. DESCRIPTION Caolán McNamara and Dom Lachowicz's wv library has been found to contain a buffer overflow condition that can be exploited through a specially crafted document. The issue lies in the handling of the DateTime field of a document as can be seen from the following lines of code taken from field.c and the function wvHandleDateTimePicture(): ... default: temp[0] = *token; temp[1] = '\0'; strcat (timestr, temp); break; } ... The above section of code can be reached if the wv library is presented with a token that it does not recognize. The utilization of the insecure function call strcat() without appropriate bounds checking leads to a classic and exploitable buffer overflow. The following is a walkthrough of a sample exploitation of the buffer overflow that will execute the command "id > /tmp/wv_exploit" upon success. $ id luid=501(farmer) gid=501(farmer) groups=501(farmer) $ ls /tmp/wv_exploit ls: /tmp/wv_exploit: No such file or directory $ dd if=wv_exploit.doc of=a3.doc ibs=1 count=42945 42945+0 records in 83+1 records out $ perl wv_exploit.pl >> a3.doc $ wvHtml wv_exploit.doc exploit.html $ cat /tmp/wv_exploit uid=501(farmer) gid=501(farmer) groups=501(farmer) The final exploit document size must be a multiple of 4096 bytes to be valid. Because of some input filtering the shellcode and return address can only contain ASCII characters (00-7f) not including any of the following: 0x22, 0x60, 0x48, 0x68, 0x41, 0x61, 0x4d, 0x6d, 0x53, 0x73, 0x44, 0x64, 0x59, 0x79. III. ANALYSIS If an attacker can convince a user to open an exploit document in HTML mode using an application that builds upon the wv library, it is possible for the attacker to execute arbitrary code under the privileges of that user. IV. DETECTION iDEFENSE has confirmed the existence of this vulnerability in version 0.7.4, and a slight variant of this vulnerability in versions 0.7.5, 0.7.6 and 1.0.0. V. WORKAROUND Users should be careful to open documents from only trusted sources. When opening Microsoft Word documents with applications utilizing the wv library ensure that HTML view is not enabled. Careful low-level scrutiny of the document in question can also reveal whether or not the document is valid or not. VI. VENDOR RESPONSE Dom Lachowicz has posted the following patch details: http://www.abisource.com/bonsai/cvsview2.cgi?diff_mode=context&whitespac e_mode=show&root=/cvsroot&subdir=wv&command=DIFF_FRAMESET&root=/cvsroot& file=field.c&rev1=1.19&rev2=1.20 VII. CVE INFORMATION The Common Vulnerabilities and Exposures (CVE) project has assigned the name CAN-2004-0645 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems. VIII. DISCLOSURE TIMELINE 06/29/2004 Initial vendor contact 07/06/2004 Vendor response 07/09/2004 Public disclosure IX. CREDIT Karol Weisek is credited with discovering this vulnerability. Get paid for vulnerability research http://www.idefense.com/poi/teams/vcp.jsp X. LEGAL NOTICES Copyright (c) 2004 iDEFENSE, Inc. Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDEFENSE. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please email customerservice@idefense.com for permission. Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html