KOffice KWord RTF importer buffer overflow
| koffice-kword-rtf-importer-bo (22562) |  High Risk |
Description:
KOffice is vulnerable to a heap-based overflow. A remote attacker could send a specially-crafted RTF file which, when it is opened by the victim, would cause a heap-based overflow and allow arbitrary code execution.
Consequences:
Gain Access
Remedy:
Apply the appropriate patch, as listed in the KDE Security Advisory 20051011-1. See References.
For Debian GNU/Linux:
Refer to DSA-872-1 for patch, upgrade, or suggested workaround information. See References.
For Gentoo Linux:
Refer to Gentoo Linux Security Announcement GLSA 2005-10-12 for patch, upgrade, or suggested workaround information. See References.
For Ubuntu Linux:
Refer to USN-202-1 for patch, upgrade, or suggested workaround information. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
References:
- KDE Security Advisory 20051011-1: KWord RTF import buffer overflow.
- KOffice Web site: The KOffice Project - KOffice - Integrated Office Suite.
- BID-15060: KDE KOffice KWord RTF Import Remote Buffer Overflow Vulnerability
- CVE-2005-2971: Heap-based buffer overflow in the KWord RTF importer for KOffice 1.2.0 through 1.4.1 allows remote attackers to execute arbitrary code via a crafted RTF file.
- DSA-872: koffice -- buffer overflow
- GLSA-200510-12: KOffice, KWord: RTF import buffer overflow
- MDKSA-2005:185: Updated koffice packages fix KWord RTF import overflow vulnerability
- SA17145: KOffice KWord RTF Importer Buffer Overflow Vulnerability
- SECTRACK ID: 1015035: KDE KWord Buffer Overflow in Importing RTF Files May Let Remote Users Execute Arbitrary Code
- SUSE-SR:2005:025: SUSE Security Summary Report
- USN-202-1: KOffice vulnerability
Platforms Affected:
- Canonical Ubuntu 5.04
- Debian Debian Linux 3.1
- Gentoo Linux
- KDE KOffice 1.2.0 - 1.4.1
- MandrakeSoft Mandrake Linux 2006 X86_64
- MandrakeSoft Mandrake Linux 2006
- MandrakeSoft Mandrake Linux LE2005
- MandrakeSoft Mandrake Linux LE2005 X86_64
Reported:
Oct 11, 2005
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net