lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAMy=nGEGE78g4RzumnQKeK+z3FZ5XhpE_azS3jFtCUhdNzn-hA@mail.gmail.com> Date: Mon, 14 May 2018 09:25:47 +0300 From: Vadim Zhukov <persgray@...il.com> To: Mohd Hanafie <nafiez.skins@...il.com> Cc: fulldisclosure@...lists.org Subject: Re: [FD] Buffer overflow in xls2csv (xlsparse.c:716) - catdoc It seems the Git repo you've mentioned isn't an official repo at all. The actual home page of this project is this: http://www.wagner.pp.ru/~vitus/software/catdoc/ -- WBR, Vadim Zhukov 2018-05-14 7:47 GMT+03:00 Mohd Hanafie <nafiez.skins@...il.com>: > Buffer overflow found in xls2csv (catdoc). Originally reported here > https://github.com/petewarden/catdoc/issues/ however, the git seems no > longer maintained. > > ==32764==ERROR: AddressSanitizer: global-buffer-overflow on address > 0x08071990 at pc 0x08050bc2 bp 0xbf86a2c8 sp 0xbf86a2b8 > READ of size 1 at 0x08071990 thread T0 > #0 0x8050bc1 in format_rk /home/john/catdoc/src/xlsparse.c:716 > #1 0x805290d in process_item /home/john/catdoc/src/xlsparse.c:325 > #2 0x8054206 in do_table /home/john/catdoc/src/xlsparse.c:116 > #3 0x804a7fb in main /home/john/catdoc/src/xls2csv.c:167 > #4 0xb776e636 in __libc_start_main > (/lib/i386-linux-gnu/libc.so.6+0x18636) > #5 0x804b5db (/usr/local/bin/xls2csv+0x804b5db) > > 0x08071990 is located 48 bytes to > =32764==ERROR: AddressSanitizer: global-buffer-overflow on address > 0x08071990 at pc 0x08050bc2 bp 0xbf86a2c8 sp 0xbf86a2b8 > READ of size 1 at 0x08071990 thread T0 > #0 0x8050bc1 in format_rk /home/john/catdoc/src/xlsparse.c:716 > #1 0x805290d in process_item /home/john/catdoc/src/xlsparse.c:325 > #2 0x8054206 in do_table /home/john/catdoc/src/xlsparse.c:116 > #3 0x804a7fb in main /home/john/catdoc/src/xls2csv.c:167 > #4 0xb776e636 in __libc_start_main > (/lib/i386-linux-gnu/libc.so.6+0x18636) > #5 0x804b5db (/usr/local/bin/xls2csv+0x804b5db) > > 0x08071990 is located 48 bytes to the left of global variable 'buffer' > defined in 'charsets.c:291:14' (0x80719c0) of size 7 > 0x08071990 is located 0 bytes to the right of global variable 'rec' defined > in 'xlsparse.c:22:22' (0x806d340) of size 18000 > SUMMARY: AddressSanitizer: global-buffer-overflow > /home/john/catdoc/src/xlsparse.c:716 format_rk > Shadow bytes around the buggy address: > 0x2100e2e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > 0x2100e2f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > 0x2100e300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > 0x2100e310: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > 0x2100e320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > =>0x2100e330: 00 00[f9]f9 f9 f9 f9 f9 07 f9 f9 f9 f9 f9 f9 f9 > 0x2100e340: 04 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 > 0x2100e350: 04 f9 f9 f9 f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9 > 0x2100e360: 04 f9 f9 f9 f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9 > 0x2100e370: 04 f9 f9 f9 f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9 > 0x2100e380: 04 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00 > Shadow byte legend (one shadow byte represents 8 application bytes): > Addressable: 00 > Partially addressable: 01 02 03 04 05 06 07 > Heap left redzone: fa > Heap right redzone: fb > Freed heap region: fd > Stack left redzone: f1 > Stack mid redzone: f2 > Stack right redzone: f3 > Stack partial redzone: f4 > Stack after return: f5 > Stack use after scope: f8 > Global redzone: f9 > Global init order: f6 > Poisoned by user: f7 > Container overflow: fc > Array cookie: ac > Intra object redzone: bb > ASan internal: fe > ==32764==ABORTING > > Attached is the POC and work with latest version 0.95. It is found that > this bug affecting the version of catdoc_0.94.3~git20160113.dbc9ec6+dfsg-1_i386 > in Ubuntu repo (latest version at least). > > > _______________________________________________ > Sent through the Full Disclosure mailing list > https://nmap.org/mailman/listinfo/fulldisclosure > Web Archives & RSS: http://seclists.org/fulldisclosure/ _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists