GNU UnRTF Font Table Conversion Buffer Overflow Vulnerability

Bugtraq ID:	12030
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 15 2004 12:00AM
Updated:	Dec 15 2004 12:00AM
Credit:	Discovery is credited to Yosef Klein and Limin Wang.
Vulnerable:	GNU UnRTF 0.19.3 + Gentoo Linux
Not Vulnerable:

GNU UnRTF Font Table Conversion Buffer Overflow Vulnerability

GNU UnRTF is prone to a buffer overflow vulnerability. This issue is exposed when the program converts RTF font table data. Since RTF documents may originate from an external or untrusted source, this vulnerability is considered to be remote in nature.

Successful exploitation will result in execution of arbitrary code.

GNU UnRTF Font Table Conversion Buffer Overflow Vulnerability

The following exploit example has been published:

• /data/vulnerabilities/exploits/81.rtf.zip

GNU UnRTF Font Table Conversion Buffer Overflow Vulnerability

Solution:
Gentoo has released an advisory to provide updates for this issue. Updates may be applied by running the following commands as the superuser:
emerge --sync
emerge --ask --oneshot --verbose ">=app-text/unrtf-0.19.3-r1"

GNU UnRTF Font Table Conversion Buffer Overflow Vulnerability

References:

• [remote] [control] unrtf 0.19.3 process_font_table overflows name buffer ("D. J. Bernstein" )
  
• UnRTF Homepage (GNU)