Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Become a Partner and License Our Database or Notification Service
wvWare Library Buffer Overflow Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID: 1010670|
SecurityTracker URL: http://securitytracker.com/id/1010670
(Links to External Site)
Date: Jul 9 2004
Execution of arbitrary code via network, User access via network|
Version(s): Tested on 0.7.4, 0.7.5, 0.7.6, and 1.0.0|
iDEFENSE reported a buffer overflow vulnerability in the wvWare library for reading Microsoft Word files. A remote user can create a specially crafted document to execute arbitrary code on the target system.|
It is reported that the overflow occurs in the wvHandleDateTimePicture() function in 'field.c' in the processing of the DateTime field.
The vendor was reportedly notified on June 29, 2004.
Karol Weisek is credited with discovering this flaw.
The original advisory is available at:
A remote user can cause the library to execute arbitrary code with the privileges of the application that uses the library.|
A patch is available at:|
Vendor URL: wvware.sourceforge.net/ (Links to External Site)
Linux (Any), UNIX (Any)|
This archive entry has one or more follow-up message(s) listed below.|
Source Message Contents
Date: Fri, 9 Jul 2004 10:39:48 -0400|
Subject: iDEFENSE Security Advisory 07.09.04: wvWare Library Buffer Overflow
wvWare Library Buffer Overflow Vulnerability
iDEFENSE Security Advisory 07.09.04
July 09, 2004
Caolán McNamara and Dom Lachowicz's wvWare is a library used to load and
parse Microsoft Word files on unix-based systems. wvWare is used in some
third-party programs to view and convert Microsoft Word documents to
Caolán McNamara and Dom Lachowicz's wv library has been found to contain
a buffer overflow condition that can be exploited through a specially
The issue lies in the handling of the DateTime field of a document as
can be seen from the following lines of code taken from field.c and the
temp = *token;
temp = '\0';
strcat (timestr, temp);
The above section of code can be reached if the wv library is presented
with a token that it does not recognize. The utilization of the insecure
function call strcat() without appropriate bounds checking leads to a
classic and exploitable buffer overflow.
The following is a walkthrough of a sample exploitation of the buffer
overflow that will execute the command "id > /tmp/wv_exploit" upon
luid=501(farmer) gid=501(farmer) groups=501(farmer)
$ ls /tmp/wv_exploit
ls: /tmp/wv_exploit: No such file or directory
$ dd if=wv_exploit.doc of=a3.doc ibs=1 count=42945
42945+0 records in
83+1 records out
$ perl wv_exploit.pl >> a3.doc
$ wvHtml wv_exploit.doc exploit.html
$ cat /tmp/wv_exploit
uid=501(farmer) gid=501(farmer) groups=501(farmer)
The final exploit document size must be a multiple of 4096 bytes to be
valid. Because of some input filtering the shellcode and return address
can only contain ASCII characters (00-7f) not including any of the
following: 0x22, 0x60, 0x48, 0x68, 0x41, 0x61, 0x4d, 0x6d, 0x53, 0x73,
0x44, 0x64, 0x59, 0x79.
If an attacker can convince a user to open an exploit document in HTML
mode using an application that builds upon the wv library, it is
possible for the attacker to execute arbitrary code under the privileges
of that user.
iDEFENSE has confirmed the existence of this vulnerability in version
0.7.4, and a slight variant of this vulnerability in versions 0.7.5,
0.7.6 and 1.0.0.
Users should be careful to open documents from only trusted sources.
When opening Microsoft Word documents with applications utilizing the wv
library ensure that HTML view is not enabled. Careful low-level scrutiny
of the document in question can also reveal whether or not the document
is valid or not.
VI. VENDOR RESPONSE
Dom Lachowicz has posted the following patch details:
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CAN-2004-0645 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org), which standardizes names for
VIII. DISCLOSURE TIMELINE
06/29/2004 Initial vendor contact
07/06/2004 Vendor response
07/09/2004 Public disclosure
Karol Weisek is credited with discovering this vulnerability.
Get paid for vulnerability research
X. LEGAL NOTICES
Copyright (c) 2004 iDEFENSE, Inc.
Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDEFENSE. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email firstname.lastname@example.org for permission.
Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
Go to the Top of This SecurityTracker Archive Page