57 lines
No EOL
1.9 KiB
Text
57 lines
No EOL
1.9 KiB
Text
#####################################################################################
|
|
|
|
Application: Oracle Outside-In LWP File Parsing Stack Based Buffer Overflow
|
|
Version: The vulnerabilities are reported in versions 8.3.5 and 8.3.7.
|
|
Exploitation: Remote code execution
|
|
|
|
Secunia Number: SA49936
|
|
|
|
{PRL}: 2012-25
|
|
|
|
Author: Francis Provencher (Protek Research Lab's)
|
|
|
|
Website: http://www.protekresearchlab.com/
|
|
|
|
Twitter: @ProtekResearch
|
|
|
|
#####################################################################################
|
|
|
|
1) Introduction
|
|
2) Timeline
|
|
3) Technical details
|
|
4) PoC
|
|
|
|
|
|
#####################################################################################
|
|
|
|
===============
|
|
1) Introduction
|
|
===============
|
|
Oracle Outside In Technology provides software developers with a comprehensive solution to access,
|
|
transform, and control the contents of over 500 unstructured file formats. From the latest office suites,
|
|
such as Microsoft Office 2007, to specialty formats and legacy files, Outside In Technology provides software
|
|
developers with the tools to transform unstructured files into controllable information.
|
|
#####################################################################################
|
|
|
|
============
|
|
2) Timeline
|
|
============
|
|
|
|
2012-07-03 - Vulnerability reported to secunia
|
|
2012-07-19 - Coordinated public release of advisory
|
|
|
|
#####################################################################################
|
|
|
|
=================
|
|
3) Technical details
|
|
=================
|
|
An error in the LWPAPIN.DLL module when processing Lotus WordPro documents can be
|
|
exploited to cause a stack-based buffer overflow via a specially crafted file.
|
|
#####################################################################################
|
|
|
|
=============
|
|
4) The Code
|
|
=============
|
|
|
|
http://www.protekresearchlab.com/exploits/PRL-2012-25.lwp
|
|
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19961.lwp |