From djb@cr.yp.to Wed Dec 15 14:20:26 2004 
Date: 15 Dec 2004 08:12:17 -0000 
From: D. J. Bernstein <djb@cr.yp.to> 
To: securesoftware@list.cr.yp.to, prahl@users.sourceforge.net 
Subject: [remote] [control] rtf2latex2e 1.0fc2 ReadFontTbl overflows buffer 
 
Limin Wang, a student in my Fall 2004 UNIX Security Holes course, has 
discovered a remotely exploitable security hole in rtf2latex2e. I'm 
publishing this notice, but all the discovery credits should be assigned 
to Wang. 
 
You are at risk if you take an RTF document from an email message (or a 
web page or any other source that could be controlled by an attacker) 
and feed it through rtf2latex2e. (The rtf2latex2e documentation does not 
tell users to avoid taking input from the network.) Whoever provides 
that document then has complete control over your account: she can read 
and modify your files, watch the programs you're running, etc. 
 
Proof of concept: On an x86 computer running FreeBSD 4.10, type 
 
   wget 
http://umn.dl.sourceforge.net/sourceforge/rtf2latex2e/rtf2latex2eUnix1.tar.gz 
   gunzip < rtf2latex2eUnix1.tar.gz | tar -xf - 
   cd rtf2latex2eUnix-1.0fc1 
   cd Unix 
   ./configure i386-unknown-freebsd4.10 
   make 
 
to download and compile the rtf2latex2e program, version 1.0fc2 
(current). Then save the file 5.rtf attached to this message, and type 
 
   env RTF2LATEX2E_DIR=`cd ..;pwd` ../rtf2latex2e.bin 5.rtf 
 
with the unauthorized result that all files are removed from the current 
directory. (I tested this with a 552-byte environment, as reported by 
printenv | wc -c.) 
 
Here's the bug: In reader.c, ReadFontTbl() reads any number of bytes 
into a 1024-byte buf[] array. 
 
---D. J. Bernstein, Associate Professor, Department of Mathematics, 
Statistics, and Computer Science, University of Illinois at Chicago 
 
    [ Part 2, Application/RTF  1.2KB. ] 
    [ Unable to print this part. ]