KDE KWord Buffer Overflow in Importing RTF Files May Let Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1015035
|
|
SecurityTracker URL: http://securitytracker.com/id?1015035
|
|
CVE Reference: CVE-2005-2971
(Links to External Site)
|
Updated: Jan 24 2008
|
Original Entry Date: Oct 11 2005
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: KDE Security Advisory
|
Version(s): KOffice 1.2.0 through 1.4.1.
|
Description: A vulnerability was reported in KDE KOffice. A remote user can cause arbitrary code to be executed on the target user's system.
A remote user can create a specially crafted RTF document that, when imported by the target user, will trigger a buffer overflow
in KWord. Arbitrary code may be executed on the target user's system with the privileges of the target user.
The vendor credits
Chris Evans with reporting this vulnerability.
The original advisory is available at:
http://www.kde.org/info/security/advisory-20051011-1.txt
|
Impact: A remote user can create a file that, when imported by the target user, will cause arbitrary code to be executed on the target user's system with the privileges of the target user.
|
Solution: The vendor has issued a fix.
Patch for KOffice 1.4.1 is available from
ftp://ftp.kde.org/pub/kde/security_patches
:
9f77b327119fd1db0752dab785e2a975 post-koffice-1.4.1-rtfimport.diff
Patch for KOffice 1.3.5 is available
from
ftp://ftp.kde.org/pub/kde/security_patches :
71a1baa8244dbcc1bfc2bd3c3e3dd40f post-koffice-1.3.5-rtfimport.diff
Patch for KOffice 1.2.1 is available from
ftp://ftp.kde.org/pub/kde/security_patches :
b36488a186aded0f5e812397af3c689a
post-koffice-1.2.1-rtfimport.diff
|
Vendor URL: www.kde.org/info/security/advisory-20051011-1.txt (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Linux (Any), UNIX (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 11 Oct 2005 12:28:41 -0400
Subject: KDE Security Advisory
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
KDE Security Advisory: KWord RTF import buffer overflow
Original Release Date: 2005-10-11
URL: http://www.kde.org/info/security/advisory-20051011-1.txt
0. References
CAN-2005-2971
CESA-2005-005
1. Systems affected:
All KOffice releases starting from KOffice 1.2.0 up to
including KOffice 1.4.1.
2. Overview:
Chris Evans reported a heap based buffer overflow in
the RTF importer of KWord.
3. Impact:
Opening specially crafted RTF files in KWord can cause
execution of abitrary code.
4. Solution:
Source code patches have been made available which fix these
vulnerabilities. Contact your OS vendor / binary package provider
for information about how to obtain updated binary packages.
5. Patch:
Patch for KOffice 1.4.1 is available from
ftp://ftp.kde.org/pub/kde/security_patches :
9f77b327119fd1db0752dab785e2a975 post-koffice-1.4.1-rtfimport.diff
Patch for KOffice 1.3.5 is available from
ftp://ftp.kde.org/pub/kde/security_patches :
71a1baa8244dbcc1bfc2bd3c3e3dd40f post-koffice-1.3.5-rtfimport.diff
Patch for KOffice 1.2.1 is available from
ftp://ftp.kde.org/pub/kde/security_patches :
b36488a186aded0f5e812397af3c689a post-koffice-1.2.1-rtfimport.diff
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)
iD8DBQFDS67hvsXr+iuy1UoRAvtpAJ4oQKIRrUIPZVKYcKnza6xWBPEJEgCgpj83
jDblSEBDBg6Cjcq8bxwaQ8M=
=pJjx
-----END PGP SIGNATURE-----
|
|
