Bugtraq mailing list archives
Re: Riched20.DLL attribute label buffer overflow vulnerability
From: "Thor Larholm" <thor () pivx com>
Date: Fri, 21 Feb 2003 11:28:39 +0100
Since RTF files are opened and rendered automatically by Outlook Express and Internet Explorer, this is remotely exploitable through mail and web. I had some problems reproducing this on Windows 2000, anyone had better luck? Regards Thor Larholm PivX Solutions, LLC - Senior Security Researcher Latest PivX research: Multi-Vendor Unreal Engine Advisory http://www.pivx.com/press_releases/ueng-adv_pr.html ----- Original Message ----- From: "Jie Dong" <Thkrdev () yoursft com> To: <bugtraq () securityfocus com> Sent: Sunday, February 16, 2003 2:30 PM Subject: Riched20.DLL attribute label buffer overflow vulnerability
===========================================================================
===== Security Defence Stdio vulnerability announcement [001] Riched20.DLL attribute label buffer overflow vulnerability URL:http:\\www.yoursft.com Author: Thrkdev finds date:2003年2月1日 Announce date:2003年2月14日 Affected system: Microsoft Windows 98 Microsoft Windows 2000 Microsoft Windows XP Perhaps,this vulnerability was still in other operating system, but untest . EMAIL: Thkrdev () yoursft com ------------------------------------------------------------------------ Technical description: A buffer overflow vulnerability exists in riched20.dll,which can result in the collapse of the application program that use the corresponding function of the DLL module, But it is very difficult to have the effect of allowing an attacker to execute commands on a user's system. This problem exists in the analysed RTF file code, and there is an overflows when drawing figure-string( such as the size of the character) in the file form .This overflow seem not to be used for executing commands. The following RTFfile may result in illegal operation : {\rtf1\ansi\ansicpg936\deff0\deflang1033\deflangfe2052{\fonttbl{\f0 \fnil\fprq2\fcharset134 \'cb\'ce\'cc\'e5;}} {\colortbl ;\red255\green0\blue255;} \viewkind4\uc1\pard\cf1\kerning2\f0 \fs18121111111111111111111111111111111110000 www.yoursft.com\fs20\par } "\fs" was used for setting the size of the followingly words "www.yoursft.com". when the figure-string that set the size of the fonts exceeding 1024byte(>1024b) , it Will cause the buffer overflow ;And when exceeding 65536byte(>65536b) it will probably cause crashing the application program. This promblom Not only appear in the setting of "\fs" , other attribute will have the same problem under the similar situation. And this following RTF files Will also result in operating illegally : {\rtf1\ansi\ansicpg936\deff0\deflang1033\deflangfe2052{\fonttbl{\f0 \fnil\fprq2\fcharset134 \'cb\'ce\'cc\'e5;}} {\colortbl ;\red255\green0\blue255;} \viewkind4\uc1\pard\cf1\kerning2\f0121111111111111111111111111111111112222 \fs180 www.yoursft.com\fs20\par } The terrible thing is nowadays lots of software was affected by this vulnerability. The attacker can send a malicious message that include exploiting the vulnerability, then when you read this message your program will be crashed. ------------------------------------------------------------------------ Security Defence Stdio is a software development / technological websites, mainly developing NET security products , the software of Security Defence Stdio --Trojan Ender-- receives users' extensive favorable comment
Current thread:
- Riched20.DLL attribute label buffer overflow vulnerability Jie Dong (Feb 17)
- Re: Riched20.DLL attribute label buffer overflow vulnerability Thor Larholm (Feb 21)
- Re: Riched20.DLL attribute label buffer overflow vulnerability Raistlin (Feb 24)
- <Possible follow-ups>
- Re: Riched20.DLL attribute label buffer overflow vulnerability 3APA3A (Feb 18)
- Re: Riched20.DLL attribute label buffer overflow vulnerability Marc Ruef (Feb 25)
- Re: Riched20.DLL attribute label buffer overflow vulnerability Thor Larholm (Feb 21)