Re: [fuzzing] OWASP Fuzzing page

[Joxean Koret]

--=-DY982N2ZYost9dLcfc6H
Content-Type: text/plain; charset=ISO-8859-15
Content-Transfer-Encoding: quoted-printable


Wow! That's fun! The so called "Word 0 day" flaw also affects
OpenOffice.org! At least, 1.1.3. And, oh! Abiword does something cool
with the file:

joxean@joxeankoret $ abiword 12122006-djtest.doc

** (AbiWord-2.2:24313): WARNING **: Invalid seek

** (AbiWord-2.2:24313): WARNING **: Invalid seek

** (AbiWord-2.2:24313): WARNING **: Invalid seek

** (AbiWord-2.2:24313): WARNING **: Invalid seek
joxean@joxeankoret $ ooffice 12122006-djtest.doc
OpenOffice.org lockfile found (/home/joxean/.openoffice/1.1.3/.lock)
Using existing OpenOffice.org
Application Errorsh: line 1: crash_report: command not found
Application Error

Fatal exception: Signal 6
Stack:
/usr/lib/openoffice/program/libsal.so.3[0xb72e13ec]
/usr/lib/openoffice/program/libsal.so.3[0xb72e1579]
/usr/lib/openoffice/program/libsal.so.3[0xb72e1644]
[0xffffe420]
/lib/tls/libc.so.6(abort+0x1d2)[0xb6c2cfa2]
/usr/lib/openoffice/program/libvcl645li.so[0xb7fadd3b]
/usr/lib/openoffice/program/libvcl645li.so(_ZN11Application5AbortERK6String=
+0x1f)[0xb7df3997]
/usr/lib/openoffice/program/soffice.bin(_ZN7desktop7Desktop9ExceptionEt
+0x53)[0x8063029]
/usr/lib/openoffice/program/libvcl645li.so(_ZN23ImplVCLExceptionHandler6sig=
nalEP13oslSignalInfo+0xb2)[0xb7df894e]
/usr/lib/openoffice/program/libvos3gcc3.so(_ZN3vos28_cpp_OSignalHandler_Fun=
ctionEPvP13oslSignalInfo+0x18)[0xb750b2f6]
/usr/lib/openoffice/program/libvos3gcc3.so(_Z24_OSignalHandler_FunctionPvP1=
3oslSignalInfo+0x26)[0xb750b2d6]
/usr/lib/openoffice/program/libsal.so.3[0xb72e1496]
/usr/lib/openoffice/program/libsal.so.3[0xb72e1625]
[0xffffe420]
/lib/tls/libc.so.6(abort+0x1d2)[0xb6c2cfa2]
/usr/lib/openoffice/program/libvcl645li.so[0xb7fadd3b]
/usr/lib/openoffice/program/libvcl645li.so(_ZN11Application5AbortERK6String=
+0x1f)[0xb7df3997]
/usr/lib/openoffice/program/soffice.bin(_ZN7desktop7Desktop9ExceptionEt
+0x174)[0x806314a]
/usr/lib/openoffice/program/libsfx645li.so(_Z18SfxNewHandler_Implv
+0x60)[0xb3042e46]
/usr/lib/openoffice/program/soffice.bin[0x80869cf]
/usr/lib/openoffice/program/soffice.bin(_Znaj+0x2f)[0x8086b61]
/usr/lib/openoffice/program/libsw645li.so[0xb1422b5e]
/usr/lib/openoffice/program/libsw645li.so[0xb1422a69]
/usr/lib/openoffice/program/libsw645li.so[0xb14243f2]
/usr/lib/openoffice/program/libsw645li.so[0xb1425022]
/usr/lib/openoffice/program/libsw645li.so[0xb14212df]
/usr/lib/openoffice/program/libsw645li.so[0xb13e59c0]
/usr/lib/openoffice/program/libsw645li.so[0xb13e7f7c]
/usr/lib/openoffice/program/libsw645li.so[0xb13e813d]
/usr/lib/openoffice/program/libsw645li.so[0xb12cc513]
/usr/lib/openoffice/program/libsw645li.so[0xb147cc4e]
/usr/lib/openoffice/program/libsfx645li.so(_ZN14SfxObjectShell6DoLoadEP9Sfx=
Medium+0xa15)[0xb2eae69d]
/usr/lib/openoffice/program/libsfx645li.so(_ZN20LoadEnvironment_Impl4LoadEP=
K16SfxObjectFactory+0x563)[0xb2e2d1ef]
/usr/lib/openoffice/program/libsfx645li.so(_ZN20LoadEnvironment_Impl17LoadD=
ataAvailableEv+0x1f3)[0xb2e2eb8d]
/usr/lib/openoffice/program/libsfx645li.so(_ZN20LoadEnvironment_Impl17LoadD=
ataAvailableEv+0x39e)[0xb2e2ed38]
/usr/lib/openoffice/program/libsfx645li.so(_ZN20LoadEnvironment_Impl5StartE=
v+0x7ca)[0xb2e2c3ba]
/usr/lib/openoffice/program/libsfx645li.so(_ZN19SfxFrameLoader_Impl4loadERK=
N3com3sun4star3uno8SequenceINS2_5beans13PropertyVa lueEEERKNS3_9ReferenceINS=
2_5frame6XFrameEEE+0x2361)[0xb2f10bb3]
/usr/lib/openoffice/program/libfwk645li.so[0xb224207a]
/usr/lib/openoffice/program/libfwk645li.so[0xb22485e4]
/usr/lib/openoffice/program/libfwk645li.so[0xb223bb1c]
/usr/lib/openoffice/program/libfwk645li.so[0xb225662c]
/usr/lib/openoffice/program/soffice.bin(_ZN7desktop15DispatchWatcher23execu=
teDispatchRequestsERKN4_STL6vectorINS0_15DispatchR equestENS1_9allocatorIS3_=
EEEE+0x230c)[0x807a34c]
/usr/lib/openoffice/program/soffice.bin(_ZN7desktop15OfficeIPCThread22Execu=
teCmdLineRequestsERNS_23ProcessDocumentsRequestE+0 x17f)[0x807138d]
/usr/lib/openoffice/program/soffice.bin(_ZN7desktop7Desktop11OpenClientsEv+=
0x1ef6)[0x80681d4]
/usr/lib/openoffice/program/soffice.bin(_ZN7desktop7Desktop16OpenClients_Im=
plEPv+0x11)[0x8065ee7]
/usr/lib/openoffice/program/soffice.bin(_ZN7desktop7Desktop24LinkStubOpenCl=
ients_ImplEPvS1_+0x18)[0x8065ed2]
/usr/lib/openoffice/program/libvcl645li.so[0xb7f49674]
/usr/lib/openoffice/program/libvcl645li.so(_Z19ImplWindowFrameProcPvP8SalFr=
ametPKv+0x44e)[0xb7f49fc2]
/usr/lib/openoffice/program/libvclplug_gen645li.so(_ZN10SalDisplay21Dispatc=
hInternalEventEv+0xd9)[0xb618ad45]
/usr/lib/openoffice/program/libvclplug_gen645li.so(_ZN13SalX11Display5Yield=
Eh+0x28)[0xb618ad80]
/usr/lib/openoffice/program/libvclplug_gen645li.so[0xb6186b28]
/usr/lib/openoffice/program/libvclplug_gen645li.so(_ZN7SalXLib5YieldEh
+0x1d3)[0xb61855db]
/usr/lib/openoffice/program/libvclplug_gen645li.so(_ZN14X11SalInstance5Yiel=
dEh+0x31)[0xb618e49b]
/usr/lib/openoffice/program/libvcl645li.so(_ZN11Application5YieldEv
+0x64)[0xb7df3baa]
/usr/lib/openoffice/program/libvcl645li.so(_ZN11Application7ExecuteEv
+0x35)[0xb7df3ab7]
/usr/lib/openoffice/program/soffice.bin(_ZN7desktop7Desktop4MainEv
+0x1f56)[0x8065446]
/usr/lib/openoffice/program/libvcl645li.so(_Z6SVMainv+0x4a)[0xb7df89bc]
/usr/lib/openoffice/program/libvcl645li.so(main+0x4c)[0xb7fade6c]
/lib/tls/libc.so.6(__libc_start_main+0xf4)[0xb6c18974]
/usr/lib/openoffice/program/soffice.bin(_ZN6Window11RequestHelpERK9HelpEven=
t+0x31)[0x805e161]
Aborted

I'm using OpenOffice.org 1.1.3 (Distributed with Debian Sarge 3.1). I
will play a little with the POC to view if it affects OOffice in a way
that code execution is possible.

---
Joxean Koret

> for something a little more technical
>=20
> This is an email I sent someone else. (sorry mate, ill give a few
> other ones for the 'project' :) )
>=20
> I do not know of any fuzzer that would find this. I do not know of
> any fuzzing method, except the one I use that would find this.
>=20
> =3D=3D=3D=3D=3D
> The file I have attached is a very basic two stage bug. stage 1 (the
> first mod) forces the code down a wrong path. the second mod by
> itsself is harmless, however when used with the first it will be the
> first and part of the second overwrite.
>=20
> I have use 41414141 as a marker to make it easier for you to see.
>=20
> I have made it crash the wordviewer again to make it more obvious
>=20
> Weight,
> location: 00000274
> value : 00000022 - just so it crashes, values 00000001 -> 00000006
> are probably the most useful for trying to overwrite a pointer. notice
> that neighbouring areas can be weighted the same.
>=20
> marker,
> location: 000027e4
> value : 41414141
>=20
> the weight destination address =3D=3D ((weight * 4[this is EDI]) + 4
> [ECX*4]) + source memory offest[ESI].
>=20
> [also the meta data is microsofts, not mine]
> =3D=3D=3D=3D=3D=3D
>=20
> bug hugs,
>=20
> disco.
> _______________________________________________
> fuzzing mailing list
> fuzzing@whitestar.linuxbox.org
> http://www.whitestar.linuxbox.org/mailman/listinfo/fuzzing
--=20
-----------------------------------
Agian, agian, eg=FCn batez
jeikiko dira egiazko Ziberotarrak,
egiazko e=FCskald=FCnak,
tirano arrotzen hiltzeko=20
eta gure aiten aitek =FCtzi daikien=20
lurraren pop=FCliari erremetitzeko.
-----------------------------------

--=-DY982N2ZYost9dLcfc6H
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: Esta parte del mensaje =?ISO-8859-1?Q?est=E1?= firmada
digitalmente

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQBFfviVU6rFMEYDrlERAmXIAKCWh7YuiMHOc9bXiYuFS4 fyZec0dACbBXkF
XXwX79Bec7v/pXZlGafGfVg=
=+V8k
-----END PGP SIGNATURE-----

--=-DY982N2ZYost9dLcfc6H--





______________________________________________
LLama Gratis a cualquier PC del Mundo.
Llamadas a fijos y móviles desde 1 céntimo por minuto.
http://es.voice.yahoo.com