Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
seebugRootSSV:96798
HistoryNov 06, 2017 - 12:00 a.m.

Apache OpenOffice DOC ImportOldFormatStyles Code Execution Vulnerability(CVE-2017-12608)

2017-11-0600:00:00
Root
www.seebug.org
32

0.002 Low

EPSS

Percentile

53.2%

JSON

Summary

An exploitable out-of-bounds write vulnerability exists in the WW8RStyle::ImportOldFormatStyles functionality of Apache OpenOffice 4.1.3. A specially crafted doc file can cause a out-of-bounds write resulting in arbitrary code execution. An attacker can send/provide malicious doc file to trigger this vulnerability.

Tested Versions

Apache OpenOffice 4.1.3

Product URLs

http://www.openoffice.org/

CVSSv3 Score

8.3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

CWE

CWE-787 - Out-of-bounds Write

Details

This vulnerability is present in Apache OpenOffice (formerly OpenOffice.org), a free open source office suite. A specially crafted DOC file can lead to an out-of-bounds write and ultimately to remote code execution.

Let’s investigate this vulnerability. After opening Writer with a malformed doc file we see the following state:

gdb-peda$ context
[----------------------------------registers-----------------------------------]
EAX: 0xab73dffc --> 0x0 
EBX: 0xab90d3fc --> 0x15ecc8 
ECX: 0xbfffd0d8 --> 0xab73849c --> 0x106 
EDX: 0xb6c ('l\x0b')
ESI: 0xb6c ('l\x0b')
EDI: 0xbfffd0d8 --> 0xab73849c --> 0x106 
EBP: 0xbfffd138 --> 0xbfffd158 --> 0xbfffd1a8 --> 0xbfffd3e8 --> 0xbfffd6a8 (0xbfffd738)
ESP: 0xbfffd050 --> 0xb7fff000 --> 0x23f3c 
EIP: 0xab887c90 (mov    BYTE PTR [eax+0x4],0x0)
EFLAGS: 0x210286 (carry PARITY adjust zero SIGN trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
   0xab887c87:  mov    eax,edi
   0xab887c89:  mov    edx,esi
   0xab887c8b:  call   0xab886212
=> 0xab887c90:  mov    BYTE PTR [eax+0x4],0x0
   0xab887c94:  mov    al,BYTE PTR [ebp-0x10]
   0xab887c97:  mov    BYTE PTR [ebp-0xd1],al
   0xab887c9d:  inc    al
   0xab887c9f:  je     0xab887d2c
[------------------------------------stack-------------------------------------]
0000| 0xbfffd050 --> 0xb7fff000 --> 0x23f3c 
0004| 0xbfffd054 --> 0x82587d8 --> 0xab7ae000 --> 0x464c457f 
0008| 0xbfffd058 --> 0xbfffd070 --> 0x20001 
0012| 0xbfffd05c --> 0xab7b875e ("_ZN14SvxLRSpaceItemC1Et")
0016| 0xbfffd060 --> 0x0 
0020| 0xbfffd064 --> 0xffd104 
0024| 0xbfffd068 --> 0xb7837c7b (<__pthread_mutex_unlock_usercnt+11>:   add    
    edi,0x10385)
0028| 0xbfffd06c --> 0xb7fd0af8 --> 0x1bf974 
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
gdb-peda$ bt
#0  0xab887c90 in ?? () from /opt/openoffice4/program/libmsword.so
#1  0xab888507 in ?? () from /opt/openoffice4/program/libmsword.so
#2  0xab88d9a3 in ?? () from /opt/openoffice4/program/libmsword.so
#3  0xab876b17 in ?? () from /opt/openoffice4/program/libmsword.so
#4  0xab8786ec in ?? () from /opt/openoffice4/program/libmsword.so
#5  0xab878a8b in ?? () from /opt/openoffice4/program/libmsword.so
#6  0xab879f9a in ?? () from /opt/openoffice4/program/libmsword.so
#7  0xac162c7b in ?? () from /opt/openoffice4/program/../program/libsw.so
#8  0xac21c730 in ?? () from /opt/openoffice4/program/../program/libsw.so
#9  0xb7408b73 in SfxObjectShell::DoLoad(SfxMedium*) () from 
     /opt/openoffice4/program/libsfx.so
#10 0xb7434353 in 
SfxBaseModel::load(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> 
const&) () from /opt/openoffice4/program/libsfx.so
#11 0xb749aaa4 in ?? () from /opt/openoffice4/program/libsfx.so
#12 0xb4e0c621 in ?? () from /opt/openoffice4/program/libfwk.so
#13 0xb4e0cf19 in ?? () from /opt/openoffice4/program/libfwk.so
#14 0xb4dbec7a in ?? () from /opt/openoffice4/program/libfwk.so
#15 0xb4dbeec4 in ?? () from /opt/openoffice4/program/libfwk.so
#16 0xb77b7715 in    
comphelper::SynchronousDispatch::dispatch(com::sun::star::uno::Reference<com::sun::star::uno ::XInterface> const&, rtl::OUString const&, rtl::OUString const&, long,
com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) ()from    
/opt/openoffice4/program/libcomphelpgcc3.so
#17 0xb7dd9bf4 in ?? () from /opt/openoffice4/program/libsofficeapp.so
#18 0xb7de2a92 in ?? () from /opt/openoffice4/program/libsofficeapp.so
#19 0xb7dc61cd in ?? () from /opt/openoffice4/program/libsofficeapp.so
#20 0xb7dc650b in ?? () from /opt/openoffice4/program/libsofficeapp.so
#21 0xb7dc65b3 in ?? () from /opt/openoffice4/program/libsofficeapp.so
#22 0xb64784dd in ?? () from /opt/openoffice4/program/libvcl.so
#23 0xb66dd92e in ?? () from /opt/openoffice4/program/libvcl.so
#24 0xb2fb7de9 in ?? () from /opt/openoffice4/program/libvclplug_gen.so
#25 0xb2fc3b52 in SalDisplay::DispatchInternalEvent() () from 
/opt/openoffice4/program/libvclplug_gen.so
#26 0xb3074fa9 in ?? () from /opt/openoffice4/program/libvclplug_gtk.so
#27 0xb3074fd8 in ?? () from /opt/openoffice4/program/libvclplug_gtk.so
#28 0xb2d82610 in ?? () from /lib/i386-linux-gnu/libglib-2.0.so.0
#29 0xb2d85d9b in g_main_context_dispatch () from /lib/i386-linux-gnu/libglib-2.0.so.0
#30 0xb2d86189 in ?? () from /lib/i386-linux-gnu/libglib-2.0.so.0
#31 0xb2d86254 in g_main_context_iteration () from /lib/i386-linux-gnu/libglib-2.0.so.0
#32 0xb3074d80 in ?? () from /opt/openoffice4/program/libvclplug_gtk.so
#33 0xb2fcafb9 in X11SalInstance::Yield(bool, bool) () from 
/opt/openoffice4/program/libvclplug_gen.so
#34 0xb6484ff2 in ?? () from /opt/openoffice4/program/libvcl.so
#35 0xb6481dbe in Application::Yield(bool) () from /opt/openoffice4/program/libvcl.so
#36 0xb6483ccb in Application::Execute() () from /opt/openoffice4/program/libvcl.so
#37 0xb7dc32a0 in ?? () from /opt/openoffice4/program/libsofficeapp.so
#38 0xb6488d8b in ?? () from /opt/openoffice4/program/libvcl.so
#39 0xb6488e79 in SVMain() () from /opt/openoffice4/program/libvcl.so
#40 0xb7de3e10 in soffice_main () from /opt/openoffice4/program/libsofficeapp.so
#41 0x08048c84 in main ()
#42 0xb789a637 in __libc_start_main (main=0xab9bf618, argc=0xab8884df, 
argv=0xab90d3fc, init=0xab963010, fini=0xbfffd1a8, rtld_fini=0xab88d9a3, 
stack_end=0xaae2c5a8) at ../csu/libc-
start.c:291

The write to `eax+0x4` causes an access violation because :

gdb-peda$ vmmap $eax+4
Start      End        Perm      Name
0xab73e000 0xab795000 r-xp      /opt/openoffice4/program/libunoxml.so

Let's investigate the vulnerable code:

sw\source\filter\ww8\ww8par2.cxx
Line 4462   void WW8RStyle::ImportOldFormatStyles()
            {
                (...)
Line 4474               sal_uInt16 cstcStd;
Line 4475               rSt >> cstcStd;
Line 4476
Line 4477               sal_uInt16 cbName;
Line 4478               rSt >> cbName;
Line 4479               sal_uInt16 nByteCount = 2;
Line 4480               sal_uInt16 stcp=0;
Line 4481               while (nByteCount < cbName)
                        {
                            (...)
Line 4518                   stcp++
                        }
                        (...)
Line 4521               sal_uInt16 nStyles=stcp;
Line 4522
Line 4523               std::vector<pxoffset> aCHPXOffsets(stcp);
Line 4524               sal_uInt16 cbChpx;
Line 4525               rSt >> cbChpx;
Line 4526               nByteCount = 2;
Line 4527               stcp=0;
Line 4528               std::vector< std::vector<sal_uInt8> > aConvertedChpx;
Line 4529               while (nByteCount < cbChpx)
Line 4530               {
Line 4531                   sal_uInt8 cb;
Line 4532                   rSt >> cb;
Line 4533                   nByteCount++;
Line 4534
Line 4535                   aCHPXOffsets[stcp].mnSize = 0;      
                        (...)
Line 4553                   stcp++;
                        }

At line 4480 we see that stcp is initialized with a 0 value. Next, if read directly from the file, cbName value won’t be bigger than 2, stcp won’t be increased and stay with initialized value (0). Based on stcp at line 4523, the aCHPXOffsets vector is allocated. The cbChpx variable value is read directly from the file at line 4525 and then used as a constrain in a while loop. The while loop will be executed as many times as indicated by cbChpx, there is no check to see whether its value is greater than stcp, which leads to an out-of-bounds write at line 4535. That situation causes memory corruption and can lead to arbitrary code execution by the attacker.

Values for significant variables are coming from offset 0xFF:
Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

000000F0                                                 09                  .
00000100   00 00 00 00 88 88 00 05                            ....ˆˆ..    

cstcStd = WORD 09 00
cbName  = WORD 00 00
cbChpx  = WORD 88 88

Crash Information

gdb-peda$ context
[----------------------------------registers-----------------------------------]
EAX: 0xab73dffc --> 0x0 
EBX: 0xab90d3fc --> 0x15ecc8 
ECX: 0xbfffd0d8 --> 0xab73849c --> 0x106 
EDX: 0xb6c ('l\x0b')
ESI: 0xb6c ('l\x0b')
EDI: 0xbfffd0d8 --> 0xab73849c --> 0x106 
EBP: 0xbfffd138 --> 0xbfffd158 --> 0xbfffd1a8 --> 0xbfffd3e8 --> 0xbfffd6a8 (0xbfffd738)
ESP: 0xbfffd050 --> 0xb7fff000 --> 0x23f3c 
EIP: 0xab887c90 (mov    BYTE PTR [eax+0x4],0x0)
EFLAGS: 0x210286 (carry PARITY adjust zero SIGN trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
   0xab887c87:  mov    eax,edi
   0xab887c89:  mov    edx,esi
   0xab887c8b:  call   0xab886212
=> 0xab887c90:  mov    BYTE PTR [eax+0x4],0x0
   0xab887c94:  mov    al,BYTE PTR [ebp-0x10]
   0xab887c97:  mov    BYTE PTR [ebp-0xd1],al
   0xab887c9d:  inc    al
   0xab887c9f:  je     0xab887d2c
[------------------------------------stack-------------------------------------]
0000| 0xbfffd050 --> 0xb7fff000 --> 0x23f3c 
0004| 0xbfffd054 --> 0x82587d8 --> 0xab7ae000 --> 0x464c457f 
0008| 0xbfffd058 --> 0xbfffd070 --> 0x20001 
0012| 0xbfffd05c --> 0xab7b875e ("_ZN14SvxLRSpaceItemC1Et")
0016| 0xbfffd060 --> 0x0 
0020| 0xbfffd064 --> 0xffd104 
0024| 0xbfffd068 --> 0xb7837c7b (<__pthread_mutex_unlock_usercnt+11>:   add    edi,0x10385)
0028| 0xbfffd06c --> 0xb7fd0af8 --> 0x1bf974 
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
gdb-peda$ exploitable -m
Warning: machine string printing is deprecated and may be removed in a future release.
EXCEPTION_FAULTING_ADDRESS:0x000000ab73e000
EXCEPTION_CODE:0xb
FAULTING_INSTRUCTION:mov    BYTE PTR [eax+0x4],0x0
MAJOR_HASH:267590b160c1d882cadfa5981b70941e
MINOR_HASH:79312db15af9cfd3ad94d7a16227d7d3
STACK_DEPTH:42
STACK_FRAME:/opt/openoffice4/program/libmsword.so+0x0
STACK_FRAME:/opt/openoffice4/program/libmsword.so+0x0
STACK_FRAME:/opt/openoffice4/program/libmsword.so+0x0
STACK_FRAME:/opt/openoffice4/program/libmsword.so+0x0
STACK_FRAME:/opt/openoffice4/program/libmsword.so+0x0
STACK_FRAME:/opt/openoffice4/program/libmsword.so+0x0
STACK_FRAME:/opt/openoffice4/program/libmsword.so+0x0
STACK_FRAME:/opt/openoffice4/program/libsw.so+0x0
STACK_FRAME:/opt/openoffice4/program/libsw.so+0x0
STACK_FRAME:/opt/openoffice4/program/libsfx.so!SfxObjectShell::DoLoad(SfxMedium*)+
    0x0
   STACK_FRAME:/opt/openoffice4/program/libsfx.so!SfxBaseModel::load(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&)+0x0
STACK_FRAME:/opt/openoffice4/program/libsfx.so+0x0
STACK_FRAME:/opt/openoffice4/program/libfwk.so+0x0
STACK_FRAME:/opt/openoffice4/program/libfwk.so+0x0
STACK_FRAME:/opt/openoffice4/program/libfwk.so+0x0
STACK_FRAME:/opt/openoffice4/program/libfwk.so+0x0 
    STACK_FRAME:/opt/openoffice4/program/libcomphelpgcc3.so!comphelper::Synchronous
    Dispatch::dispatch(com::sun::star::uno::Reference<com::sun::star::uno::XInterface> const&,     
    rtl::OUString  
    const&, rtl::OUString const&, long, 
    com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&)+0x0

      STACK_FRAME:/opt/openoffice4/program/libcomphelpgcc3.so!comphelper::SynchronousDispatch::dispatch
STACK_FRAME:/opt/openoffice4/program/libsofficeapp.so+0x0
STACK_FRAME:/opt/openoffice4/program/libsofficeapp.so+0x0
STACK_FRAME:/opt/openoffice4/program/libsofficeapp.so+0x0
STACK_FRAME:/opt/openoffice4/program/libsofficeapp.so+0x0
STACK_FRAME:/opt/openoffice4/program/libsofficeapp.so+0x0
STACK_FRAME:/opt/openoffice4/program/libvcl.so+0x0
STACK_FRAME:/opt/openoffice4/program/libvcl.so+0x0
STACK_FRAME:/opt/openoffice4/program/libvclplug_gen.so+0x0
STACK_FRAME:/opt/openoffice4/program/libvclplug_gen.so!SalDisplay::DispatchInternalEv
    ent()+0x0
STACK_FRAME:/opt/openoffice4/program/libvclplug_gtk.so+0x0
STACK_FRAME:/opt/openoffice4/program/libvclplug_gtk.so+0x0
STACK_FRAME:/lib/i386-linux-gnu/libglib-2.0.so.0.4800.2+0x0
STACK_FRAME:/lib/i386-linux-gnu/libglib-2.0.so.0.4800.2!g_main_context_dispatch+0x0
STACK_FRAME:/lib/i386-linux-gnu/libglib-2.0.so.0.4800.2+0x0
STACK_FRAME:/lib/i386-linux-gnu/libglib-2.0.so.0.4800.2!g_main_context_iteration+0x0
STACK_FRAME:/opt/openoffice4/program/libvclplug_gtk.so+0x0
STACK_FRAME:/opt/openoffice4/program/libvclplug_gen.so!X11SalInstance::Yield(bool, 
    bool)+0x0
STACK_FRAME:/opt/openoffice4/program/libvcl.so+0x0
STACK_FRAME:/opt/openoffice4/program/libvcl.so!Application::Yield(bool)+0x0
STACK_FRAME:/opt/openoffice4/program/libvcl.so!Application::Execute()+0x0
STACK_FRAME:/opt/openoffice4/program/libsofficeapp.so+0x0
STACK_FRAME:/opt/openoffice4/program/libvcl.so+0x0
STACK_FRAME:/opt/openoffice4/program/libvcl.so!SVMain()+0x0
STACK_FRAME:/opt/openoffice4/program/libsofficeapp.so!soffice_main+0x0
STACK_FRAME:/opt/openoffice4/program/soffice.bin!main+0x0
INSTRUCTION_ADDRESS:0x000000ab887c90
INVOKING_STACK_FRAME:0
DESCRIPTION:Access violation on destination operand
SHORT_DESCRIPTION:DestAv (9/29)
OTHER_RULES:AccessViolation (28/29)
CLASSIFICATION:EXPLOITABLE
EXPLANATION:The target crashed on an access violation at an address matching the 
destination operand of the instruction. This likely indicates a write access violation, which      
means the attacker may control the write address and/or value.
Description: Access violation on destination operand
Short description: DestAv (9/29)
Hash: 267590b160c1d882cadfa5981b70941e.79312db15af9cfd3ad94d7a16227d7d3
Exploitability Classification: EXPLOITABLE
Explanation: The target crashed on an access violation at an address matching the destination     
operand of the instruction. This likely indicates a write access violation, which means the 
attacker may control the write address and/or value.
Other tags: AccessViolation (28/29)

Timeline

  • 2017-04-05 - Vendor Disclosure
  • 2017-10-26 - Public Release

Related

talos 1
cve 1
ubuntucve 1
cvelist 1
debiancve 1
prion 1
nvd 1
redhatcve 1
nessus 7
osv 2
ubuntu 1
openvas 5
debian 2
talosblog 1
threatpost 1
freebsd 1
talos
talos
Apache OpenOffice DOC ImportOldFormatStyles Code Execution Vulnerability
2017-10-26 00:00:00
cve
cve
CVE-2017-12608
2017-11-20 20:29:00
ubuntucve
ubuntucve
CVE-2017-12608
2017-11-01 00:00:00
cvelist
cvelist
CVE-2017-12608
2017-11-19 00:00:00
debiancve
debiancve
CVE-2017-12608
2017-11-20 20:29:00
prion
prion
Memory corruption
2017-11-20 20:29:00
nvd
nvd
CVE-2017-12608
2017-11-20 20:29:00
redhatcve
redhatcve
CVE-2017-12608
2017-10-31 08:49:43
nessus
nessus
Ubuntu 14.04 LTS : LibreOffice vulnerabilities (USN-3472-1)
2017-11-03 00:00:00
Debian DSA-4022-1 : libreoffice - security update
2017-11-09 00:00:00
Debian DLA-1214-1 : libreoffice security update
2017-12-21 00:00:00
osv
osv
libreoffice - security update
2017-11-07 00:00:00
libreoffice - security update
2017-12-20 00:00:00
ubuntu
ubuntu
LibreOffice vulnerabilities
2017-11-02 00:00:00
openvas
openvas
Debian: Security Advisory (DSA-4022-1)
2017-11-06 00:00:00
Debian: Security Advisory (DLA-1214-1)
2023-03-08 00:00:00
Ubuntu: Security Advisory (USN-3472-1)
2017-11-04 00:00:00
debian
debian
[SECURITY] [DSA 4022-1] libreoffice security update
2017-11-08 21:17:41
[SECURITY] [DLA 1214-1] libreoffice security update
2017-12-20 22:26:14
talosblog
talosblog
Vulnerability Spotlight: Apache OpenOffice Vulnerabilities
2017-10-26 07:26:00
threatpost
threatpost
Apache OpenOffice Update Patches Four Vulnerabilities
2017-10-28 07:00:08
freebsd
freebsd
Apache OpenOffice -- multiple vulnerabilities
2016-09-11 00:00:00

0.002 Low

EPSS

Percentile

53.2%

JSON
Related for SSV:96798
talos1cve1ubuntucve1cvelist1debiancve1prion1nvd1redhatcve1nessus7osv2ubuntu1openvas5debian2talosblog1threatpost1freebsd1