Bug 14882 - unrtf denial of service issues fixed upstream in 0.21.8
Summary: unrtf denial of service issues fixed upstream in 0.21.8
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 4
Hardware: i586 Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/629243/
Whiteboard: has_procedure advisory MGA4-64-OK MGA...
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2014-12-23 19:21 CET by David Walser
Modified: 2015-01-12 19:25 CET (History)
3 users (show)

See Also:
Source RPM: unrtf-0.21.7-1.mga4.src.rpm
CVE:
Status comment:


Attachments
RTF sample test file (10.03 KB, application/rtf)
2014-12-24 11:57 CET, olivier charles
Details

Description David Walser 2014-12-23 19:21:05 CET
Upstream has released 0.21.8 which should fix the remaining crasher issues:
http://openwall.com/lists/oss-security/2014/12/22/4

This is a follow-up to Bug 14783.

Hopefully it also fixes the issue in this post, which hadn't been addressed by the previous update:
http://openwall.com/lists/oss-security/2014/12/11/11

Advisory:
========================

Updated unrtf package fixes security vulnerability:

Hanno Böck also reported a number of other crashes in unrtf besides the ones
associated with CVE-2014-9275.  These could allow a denial of service when
opening a malicious malformed RTF file which causes unrtf to crash.

References:
http://openwall.com/lists/oss-security/2014/12/22/4
========================

Updated package in core/updates_testing:
========================
unrtf-0.21.8-1.mga4

from unrtf-0.21.8-1.mga4.src.rpm

Reproducible: 

Steps to Reproduce:
Comment 1 olivier charles 2014-12-24 11:57:30 CET
Created attachment 5758 [details]
RTF sample test file


Testing on Mageia 4x32 real hardware

From current package :
--------------------
unrtf-0.21.7-1.mga4

First with PoC
$ perl -e 'print "{" x 100000' > test2.rtf
$ unrtf test2.rtf
Erreur de segmentation

Then with a rtfsampletest.rtf written in LibreOffice (in attachment)

$ unrtf rtfsampletest.rtf
outputs in html format. If output copied to a html file, opens in browser ok.
$ unrtf --text rtfsampletest.rtf
outputs in ASCII characters

To updated testing package :
--------------------------
unrtf-0.21.8-1.mga4

$ perl -e 'print "{" x 100000' > test3.rtf
$ unrtf test3.rtf 
Warning: Max group depth reached (...)
gives a warning but no segmentation fault.

$ unrtf rtfsampletest.rtf
outputs in html format. If output copied to a html file, opens in browser ok.
$ unrtf --text rtfsampletest.rtf 
###  Translation from RTF performed by UnRTF, version 0.21.8 
### font table contains 13 fonts total
### creation date: 24 December 2014 10:22 
### revision date: 
### last printed: 
### comments: LibreOffice

-----------------
Error (line 71): output personality lacks sufficient font size change capability

It can't output my sample rtf test in ASCII characters anymore.

New version resolves the bug (segfault) but produces a regression on my installation.

CC: (none) => olchal

Comment 2 David Walser 2014-12-24 23:55:38 CET
Thanks Olivier.

Would you mind reporting the regression upstream?
http://savannah.gnu.org/projects/unrtf/

Whiteboard: (none) => feedback

Comment 3 olivier charles 2014-12-25 20:14:36 CET
(In reply to David Walser from comment #2)
> Thanks Olivier.
> 
> Would you mind reporting the regression upstream?
> http://savannah.gnu.org/projects/unrtf/

Done David !
Comment 4 David Walser 2014-12-25 22:09:00 CET
Thanks Olivier!

http://savannah.gnu.org/bugs/?43888
Comment 5 David Walser 2015-01-09 01:16:10 CET
Regression fixed upstream in 0.21.9.

Freeze push requested for Cauldron.

unrtf-0.21.9-1.mga4 from unrtf-0.21.9-1.mga4.src.rpm uploaded for Mageia 4.

Whiteboard: feedback => (none)

Comment 6 Otto Leipälä 2015-01-09 13:04:50 CET
Testing done with Mga4 64&32 no issues found i validate this.
Sysadmins push to updates.

CC: (none) => ozkyster, sysadmin-bugs
Whiteboard: (none) => MGA4-64-OK MGA4-32-OK

Otto Leipälä 2015-01-09 13:05:08 CET

Keywords: (none) => validated_update

Comment 7 claire robinson 2015-01-09 16:25:33 CET
Do you want to add anything to the advisory David?
Comment 8 David Walser 2015-01-09 16:26:28 CET
No, this one's ready to go.  They do need to push it in Cauldron also.
Comment 9 claire robinson 2015-01-09 16:41:28 CET
Advisory from comment 0 with srpm from comment 5 uploaded.

Whiteboard: MGA4-64-OK MGA4-32-OK => has_procedure advisory MGA4-64-OK MGA4-32-OK

Comment 10 Mageia Robot 2015-01-09 17:44:44 CET
An update for this issue has been pushed to Mageia Updates repository.

http://advisories.mageia.org/MGASA-2015-0016.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED

David Walser 2015-01-12 19:25:38 CET

URL: (none) => http://lwn.net/Vulnerabilities/629243/


Note You need to log in before you can comment on or make changes to this bug.