Multiple integer overflows in the WV library in wvWare (formerly mswordview) before 1.2.3, as used by AbiWord, KWord, and possibly other products, allow user-assisted remote attackers to execute arbitrary code via a crafted Microsoft Word (DOC) file that produces (1) large LFO clfolvl values in the wvGetLFO_records function or (2) a large LFO nolfo value in the wvGetFLO_PLF function.

Two integer overflows were found in the Microsoft Word converter library 'wv', which could potentially be used to crash programs using this library or to even execute code.

  - A LVL Count Integer Overflow Vulnerability was fixed.

  - A LFO Count Integer Overflow Vulnerability was fixed.
    Both problems have been assigned the Mitre CVE ID     CVE-2006-4513.

An integer overflow was discovered in the DOC file parser of the wv library. By tricking a user into opening a specially crafted MSWord (.DOC) file, remote attackers could execute arbitrary code with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two integer overflows were found in the Microsoft Word converter library 'wv', which could potentially be used to crash programs using this library or to even execute code.

  - A LVL Count Integer Overflow Vulnerability was fixed.

  - A LFO Count Integer Overflow Vulnerability was fixed.

Both problems have been assigned the Mitre CVE ID CVE-2006-4513.

Multiple integer overflows in the WV library in wvWare (formerly mswordview) before 1.2.3, as used by AbiWord?, KWord, and possibly other products, allow user-assisted remote attackers to execute arbitrary code via a crafted Microsoft Word (DOC) file that produces (1) large LFO clfolvl values in the wvGetLFO_records function or (2) a large LFO nolfo value in the wvGetFLO_PLF function.

Updated packages have been patched to correct these issues.

Secunia reports :

Some vulnerabilities have been reported in wvWare, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise an application using the library.

The vulnerabilities are caused due to integer overflows within the 'wvGetLFO_records()' and 'wvGetLFO_PLF()' functions. These can be exploited to cause heap-based buffer overflows by e.g. tricking a user to open a specially crafted Microsoft Word document with an application using the library.

The remote host is affected by the vulnerability described in GLSA-200612-01 (wv library: Multiple integer overflows)

    The wv library fails to do proper arithmetic checks in multiple places,     possibly leading to integer overflows.
  Impact :

    An attacker could craft a malicious file that, when handled with the wv     library, could lead to the execution of arbitrary code with the     permissions of the user running the application.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
29595	SuSE 10 Security Update : wv (ZYPP Patch Number 2280)	Nessus	SuSE Local Security Checks	medium
27955	Ubuntu 6.10 : wv vulnerability (USN-374-1)	Nessus	Ubuntu Local Security Checks	medium
27479	openSUSE 10 Security Update : wv (wv-2279)	Nessus	SuSE Local Security Checks	medium
24587	Mandrake Linux Security Advisory : wv (MDKSA-2006:202)	Nessus	Mandriva Local Security Checks	medium
23851	FreeBSD : wv -- Multiple Integer Overflow Vulnerabilities (d29dc506-8aa6-11db-bd0d-00123ffe8333)	Nessus	FreeBSD Local Security Checks	medium
23795	GLSA-200612-01 : wv library: Multiple integer overflows	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2006-4513

high

Tenable Plugins

medium

medium

medium

medium

medium

medium