Linux.com Article DB: Staroffice has buffer overflow problems

From: Michal Zalewski Subject: StarOffice 5.1 To: BUGTRAQ@SECURITYFOCUS.COM

Do you remember recent Microsoft Word (and Wordpad) vulnerabilities while reading .rtf documents? I realized that Sun StarOffice 5.1 is at least so buggy as M$ products. There are a lot of ways to cause overflow and crash (or execution of arbitrary code) while viewing documents - starting from html with <a href="file://aaaaaaaaalotof...">, which will cause crash on opening this document itself (you don't have to click that link). Also, any other document with such hyperlink should cause instant crash (try saving SO native document - .sdw - with some hyperlinks, then modyfing it with binary editor). Just one example. Beautiful overflow while doing strcpy().

1:1, Microsoft's move ;)

_______________________________________________________ Michal Zalewski [lcamtuf@tpi.pl] [tp.internet/security] [http://lcamtuf.na.export.pl] <=--=> bash$ :(){ :|:&};: =-----=> God is real, unless declared integer. <=-----=

Originally Published: Monday, 17 April 2000	Author: Alexander Reelsen
Published to: news_enhance_security/Security News	Page: 1/1 - [Printable]
Staroffice has buffer overflow problems StarOffice from Sun can easily be crashed and abused by using long URL's and similar actions.

	Page 1 of 1
From: Michal Zalewski Subject: StarOffice 5.1 To: BUGTRAQ@SECURITYFOCUS.COM Do you remember recent Microsoft Word (and Wordpad) vulnerabilities while reading .rtf documents? I realized that Sun StarOffice 5.1 is at least so buggy as M$ products. There are a lot of ways to cause overflow and crash (or execution of arbitrary code) while viewing documents - starting from html with <a href="file://aaaaaaaaalotof...">, which will cause crash on opening this document itself (you don't have to click that link). Also, any other document with such hyperlink should cause instant crash (try saving SO native document - .sdw - with some hyperlinks, then modyfing it with binary editor). Just one example. Beautiful overflow while doing strcpy(). 1:1, Microsoft's move ;) _______________________________________________________ Michal Zalewski [lcamtuf@tpi.pl] [tp.internet/security] [http://lcamtuf.na.export.pl] <=--=> bash$ :(){ :\|:&};: =-----=> God is real, unless declared integer. <=-----=
	Page 1 of 1