Multiple stack-based buffer overflows in the RTF import feature in AbiWord before 2.2.11 allow user-assisted attackers to execute arbitrary code via an RTF file with long identifiers, which are not properly handled in the (1) ParseLevelText, (2) getCharsInsideBrace, (3) HandleLists, (4) or (5) HandleAbiLists functions in ie_imp_RTF.cpp, a different vulnerability than CVE-2005-2964.

Chris Evans discovered several buffer overflows in the RTF import mechanism of AbiWord, a WYSIWYG word processor based on GTK 2. Opening a specially crafted RTF file could lead to the execution of arbitrary code.

Chris Evans reports that AbiWord is vulnerable to multiple stack-based buffer overflow vulnerabilities. This is caused by improper checking of the user-supplied data before it is being copied to an too small buffer. The vulnerability is triggered when someone is importing RTF files.

Chris Evans discovered several buffer overflows in the RTF import module of AbiWord. By tricking a user into opening an RTF file with specially crafted long identifiers, an attacker could exploit this to execute arbitrary code with the privileges of the AbiWord user.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200510-17 (AbiWord: New RTF import buffer overflows)

    Chris Evans discovered a different set of buffer overflows than     the one described in GLSA 200509-20 in the RTF import function in     AbiWord.
  Impact :

    An attacker could design a malicious RTF file and entice a user to     import it in AbiWord, potentially resulting in the execution of     arbitrary code with the rights of the user running AbiWord.
  Workaround :

    There is no known workaround at this time.

CVE-2005-2972 abiword multiple buffer overflows

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
22760	Debian DSA-894-1 : abiword - buffer overflows	Nessus	Debian Local Security Checks	high
21486	FreeBSD : abiword, koffice -- stack based buffer overflow vulnerabilities (9cd52bc6-a213-11da-b410-000e0c2e438a)	Nessus	FreeBSD Local Security Checks	medium
20619	Ubuntu 4.10 / 5.04 : abiword vulnerabilities (USN-203-1)	Nessus	Ubuntu Local Security Checks	medium
20079	GLSA-200510-17 : AbiWord: New RTF import buffer overflows	Nessus	Gentoo Local Security Checks	medium
20024	Fedora Core 3 : abiword-2.0.12-11 (2005-989)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2005-2972

critical

Tenable Plugins

high

medium

medium

medium

medium