Info

Disclosure

Dec 17, 2004

Discovery

Dec 15, 2004

Dates

Exploit

Dec 15, 2004

Solution

Unknown

Description

A remote overflow exists in xlreader. xlreader fails to properly append strings to an internal array when processing an Excel document resulting in a buffer overflow. With a specially crafted request, an attacker can cause execution resulting in a loss of integrity.

Classification

Location: Remote/Network Access Required
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Available

Solution

Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

Products

David Giffin

xlreader

0.9.0

References

Security Tracker: 1012540
Bugtraq ID: 11970
Secunia Advisory ID: 13553
ISS X-Force ID: 18612
CVE ID: 2004-1301 (see also: NVD)
Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2004-12/0195.html
Other Advisory URL: http://tigger.uic.edu/~jlongs2/holes/xlreader.txt
Vendor URL: http://www.giffin.org/xlreader.php

Credit

Tom Palarz -
Kris Kubicki -

Direct URL: http://osvdb.org/36218