From djb@cr.yp.to Wed Dec 15 14:20:26 2004
Date: 15 Dec 2004 08:12:17 -0000
From: D. J. Bernstein <djb@cr.yp.to>
To: securesoftware@list.cr.yp.to, prahl@users.sourceforge.net
Subject: [remote] [control] rtf2latex2e 1.0fc2 ReadFontTbl overflows buffer

Limin Wang, a student in my Fall 2004 UNIX Security Holes course, has
discovered a remotely exploitable security hole in rtf2latex2e. I'm
publishing this notice, but all the discovery credits should be assigned
to Wang.

You are at risk if you take an RTF document from an email message (or a
web page or any other source that could be controlled by an attacker)
and feed it through rtf2latex2e. (The rtf2latex2e documentation does not
tell users to avoid taking input from the network.) Whoever provides
that document then has complete control over your account: she can read
and modify your files, watch the programs you're running, etc.

Proof of concept: On an x86 computer running FreeBSD 4.10, type

   wget http://umn.dl.sourceforge.net/sourceforge/rtf2latex2e/rtf2latex2eUnix1.tar.gz
   gunzip < rtf2latex2eUnix1.tar.gz | tar -xf -
   cd rtf2latex2eUnix-1.0fc1
   cd Unix
   ./configure i386-unknown-freebsd4.10
   make

to download and compile the rtf2latex2e program, version 1.0fc2
(current). Then save the file 5.rtf attached to this message, and type

   env RTF2LATEX2E_DIR=`cd ..;pwd` ../rtf2latex2e.bin 5.rtf

with the unauthorized result that all files are removed from the current
directory. (I tested this with a 552-byte environment, as reported by
printenv | wc -c.)

Here's the bug: In reader.c, ReadFontTbl() reads any number of bytes
into a 1024-byte buf[] array.

---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago

    [ Part 2, Application/RTF  1.2KB. ]
    [ Unable to print this part. ]