From djb@cr.yp.to Wed Dec 15 14:20:02 2004
Date: 15 Dec 2004 08:06:57 -0000
From: D. J. Bernstein <djb@cr.yp.to>
To: securesoftware@list.cr.yp.to, david@giffin.org
Subject: [remote] [control] xlreader 0.9.0 overflows insert_start buffer

Tom Palarz and Kris Kubicki, two students in my Fall 2004 UNIX Security
Holes course, have discovered a remotely exploitable security hole in
xlreader, a program to read Excel files. I'm publishing this notice, but
all the discovery credits should be assigned to Palarz and Kubicki.

You are at risk if you take an Excel document from an email message (or
a web page or any other source that could be controlled by an attacker)
and feed that document through xlreader -s. Whoever provides that
document then has complete control over your account: he can read and
modify your files, watch the programs you're running, etc.

The xlreader documentation does not tell users to avoid taking input
from the network. In fact, the xlreader web page says ``I get all my
email on a UNIX box. And frequently people will send Excel attachments.''

Proof of concept: On an x86 computer running FreeBSD 4.10, type

   wget http://umn.dl.sourceforge.net/sourceforge/xlreader/xlreader-0.9.0.tgz
   gunzip < xlreader-0.9.0.tgz | tar -xf -
   cd xlreader-0.9.0
   make

to download and compile the xlreader program, version 0.9.0 (current).
Then save the Excel document attached to this message as 1.xls, and type

   xlreader -s 1.xls > 1.sql

with the unauthorized result that a file named EXPLOITED is created in
the current directory. (I tested this with a 540-byte environment, as
reported by printenv | wc -c.)

Here's the bug: In format.c, book_format_sql() uses strcat() to append
strings to the 4096-byte insert_start[] array.

---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago

    [ Part 2, Application/EXCEL  39KB. ]
    [ Unable to print this part. ]