CVE-2004-1297

Experiment Environment

CentOS 6.5

INSTALL & Configuration

wget https://github.com/mudongliang/source-packages/raw/master/CVE-2004-1297/unrtf-0.19.3.tar.gz
tar -xvf unrtf-0.19.3.tar.gz
cd unrtf-0.19.3
make

Problems in Installation & Configuration

How to trigger vulnerability

./unrtf 81.rtf

PoCs

unrtf 0.19.3 process_font_table overflows name buffer

GNU UnRTF 0.19.3 - Font Table Conversion Buffer Overflow

GNU UnRTF Font Table Conversion Buffer Overflow Vulnerability

Vulnerability Details & Patch

Root Cause

In convert.c, process_font_table() uses an unprotected strcat() to copy any number of bytes into a 255-byte name array.

Stack Trace

References