MS12-076 Excel SerAuxErrBar Heap Overflow Vulnerability

There was a Heap Overflow vulnerability (CVE-2012-1885) in Excel while parsing SerAuxErrBar structure from xls (Excel's old binary format) files. So I decided to took on it (a little bit analysis). But I faced with reality that there is no public debugging symbols for Excel :( When I read advisory [1] I don't understand anything as always 'cause Microsoft only says "A remote code execution vulnerability exists in the way that Microsoft Excel handles specially crafted Excel files. An attacker who successfully exploited this vulnerability could take..". That's shit description :( Then I look for SerAuxErrBar structure and found something on MSDN that describes this structure [2]. But there was another question. "How one could create SerAuxErrBar structure?".

ELF File Format Parsing

In this post i will explain how to parse 32 bit ELF File Format for finding offsets of segments. Firstly we need to lookup ELF Header (First 52 bytes) for taking offsets of Program Headers Table, EntryPoint Addr, Section Headers Tables etc..

If we take an DWORD value from 24th offset of ELF Header we can grab EntryPoint of executable file. DWORD value at 32th offset is start offset of Section Headers Table and size of this headers table is located at 46th offset as a WORD value. We also need number of section headers that located at 48th offset as a WORD value. Also Section Header String Table Index is located at 50th offset as a WORD value. So we can say ELF Header structure is like this;

PE Browser

İlgili dökümanda* bahsettiğimiz PE-Browser sadece o anlık bir çözümdü, biraz daha geliştirip konsol gibi bir çözüm düşünüyoruz, yakinda başlarım onada :>


[*] http://www.adeosecurity.com/guvenlik/dump-exe-with-c-ruby/