libicu in International Components for Unicode (ICU) 3.8.1 and earlier attempts to process backreferences to the nonexistent capture group zero (aka \0), which might allow context-dependent attackers to read from, or write to, out-of-bounds memory locations, related to corruption of REStackFrames.

From Red Hat Security Advisory 2008:0090 :

Updated icu packages that fix two security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The International Components for Unicode (ICU) library provides robust and full-featured Unicode services.

Will Drewry reported multiple flaws in the way libicu processed certain malformed regular expressions. If an application linked against ICU, such as OpenOffice.org, processed a carefully crafted regular expression, it may be possible to execute arbitrary code as the user running the application. (CVE-2007-4770, CVE-2007-4771)

All users of icu should upgrade to these updated packages, which contain backported patches to resolve these issues.

Will Drewry reported multiple flaws in the way libicu processed certain malformed regular expressions. If an application linked against ICU, such as OpenOffice.org, processed a carefully crafted regular expression, it may be possible to execute arbitrary code as the user running the application. (CVE-2007-4770, CVE-2007-4771)

Updated icu packages that fix two security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The International Components for Unicode (ICU) library provides robust and full-featured Unicode services.

Will Drewry reported multiple flaws in the way libicu processed certain malformed regular expressions. If an application linked against ICU, such as OpenOffice.org, processed a carefully crafted regular expression, it may be possible to execute arbitrary code as the user running the application. (CVE-2007-4770, CVE-2007-4771)

All users of icu should upgrade to these updated packages, which contain backported patches to resolve these issues.

Will Drewry reported multiple flaws in how libicu processed certain malformed regular expressions. If an application linked against libicu, such as OpenOffice.org, processed a carefully-crafted regular expression, it could potentially cause the execution of arbitrary code with the privileges of the user running the application.

The updated packages have been patched to correct these issues.

The remote host is affected by the vulnerability described in GLSA-200805-16 (OpenOffice.org: Multiple vulnerabilities)

    iDefense Labs reported multiple vulnerabilities in OpenOffice.org:
    multiple heap-based buffer overflows when parsing the 'Attribute' and     'Font' Description records of Quattro Pro (QPRO) files     (CVE-2007-5745),     an integer overflow when parsing the EMR_STRETCHBLT record of an EMF     file, resulting in a heap-based buffer overflow (CVE-2007-5746),     an integer underflow when parsing Quattro Pro (QPRO) files, resulting     in an excessive loop and a stack-based buffer overflow     (CVE-2007-5747),     and a heap-based buffer overflow when parsing the     'DocumentSummaryInformation' stream in an OLE file (CVE-2008-0320).
    Furthermore, Will Drewry (Google Security) reported vulnerabilities in     the memory management of the International Components for Unicode     (CVE-2007-4770, CVE-2007-4771), which was resolved with GLSA 200803-20.
    However, the binary version of OpenOffice.org uses an internal copy of     said library.
  Impact :

    A remote attacker could entice a user to open a specially crafted     document, possibly resulting in the remote execution of arbitrary code     with the privileges of the user running OpenOffice.org.
  Workaround :

    There is no known workaround at this time.

This update of OpenOffice fixes various critical security vulnerabilities

  - heap-overflow when parsing PPT files (CVE-2008-0320)

  - various buffer-overflows while parsing QPRO files     (CVE-2007-5745, CVE-2007-5747)

  - out-of-bound memory access and a heap-overflow&nbsp;in     the regex engine of libICU (CVE-2007-4770,CVE-2007-4771)

The version of OpenOffice installed on the remote host is reportedly affected by several issues :

  - Heap overflow and arbitrary code execution vulnerabilities involving ODF text documents with XForms (CVE-2007-4770/4771).
  - Heap overflow and arbitrary code execution vulnerabilities involving Quattro Pro files (CVE-2007-5745/5747).
  - Heap overflow and arbitrary code execution vulnerabilities involving EMF files (CVE-2007-5746).
  - Heap overflow and arbitrary code execution vulnerabilities involving OLE files (CVE-2008-0320).

The version of Sun Microsystems OpenOffice.org installed on the remote host is affected by several issues :

  - Heap overflow and arbitrary code execution     vulnerabilities involving ODF text documents with     XForms (CVE-2007-4770/4771).

  - Heap overflow and arbitrary code execution     vulnerabilities involving Quattro Pro files     (CVE-2007-5745/5747).

  - Heap overflow and arbitrary code execution     vulnerabilities involving EMF files (CVE-2007-5746).

  - Heap overflow and arbitrary code execution     vulnerabilities involving OLE files (CVE-2008-0320).

Will Drewry discovered that libicu did not properly handle '\0' when processing regular expressions. If an application linked against libicu processed a crafted regular expression, an attacker could execute arbitrary code with privileges of the user invoking the program. (CVE-2007-4770)

Will Drewry discovered that libicu did not properly limit its backtracking stack size. If an application linked against libicu processed a crafted regular expression, an attacker could cause a denial of service via resource exhaustion. (CVE-2007-4771).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200803-20 (International Components for Unicode: Multiple vulnerabilities)

    Will Drewry (Google Security) reported a vulnerability in the regular     expression engine when using back references to capture \\0 characters     (CVE-2007-4770). He also found that the backtracking stack size is not     limited, possibly allowing for a heap-based buffer overflow     (CVE-2007-4771).
  Impact :

    A remote attacker could submit specially crafted regular expressions to     an application using the library, possibly resulting in the remote     execution of arbitrary code with the privileges of the user running the     application or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Certain regular expressions could crash the ICU library.
(CVE-2007-4770 / CVE-2007-4771)

Certain regular expressions could crash the ICU library (CVE-2007-4770, CVE-2007-4771).

CVE-2007-4770 & CVE-2007-4771 Flaws in icu regexp handling. Technical details can be found at http://sourceforge.net/mailarchive/message.php?msg_name= d03a2ffb0801221538x68825e42xb4a4aaf0fcccecbd%2540mail.gmail.com

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
67646	Oracle Linux 5 : icu (ELSA-2008-0090)	Nessus	Oracle Linux Local Security Checks	high
60352	Scientific Linux Security Update : icu on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
43673	CentOS 5 : icu (CESA-2008:0090)	Nessus	CentOS Local Security Checks	high
37215	Mandriva Linux Security Advisory : icu (MDVSA-2008:026)	Nessus	Mandriva Local Security Checks	high
32353	GLSA-200805-16 : OpenOffice.org: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
32023	openSUSE 10 Security Update : OpenOffice_org (OpenOffice_org-5053)	Nessus	SuSE Local Security Checks	high
4474	OpenOffice < 2.4 Multiple Vulnerabilities	Nessus Network Monitor	Generic	medium
31968	Sun OpenOffice.org < 2.4 Multiple Vulnerabilities	Nessus	Windows	high
31678	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : icu vulnerabilities (USN-591-1)	Nessus	Ubuntu Local Security Checks	high
31446	GLSA-200803-20 : International Components for Unicode: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
31400	SuSE 10 Security Update : icu (ZYPP Patch Number 5014)	Nessus	SuSE Local Security Checks	high
31399	openSUSE 10 Security Update : icu (icu-5013)	Nessus	SuSE Local Security Checks	high
30091	RHEL 5 : icu (RHSA-2008:0090)	Nessus	Red Hat Local Security Checks	high
30087	Fedora 7 : icu-3.6-20.fc7 (2008-1076)	Nessus	Fedora Local Security Checks	high
30086	Fedora 8 : icu-3.8-5.fc8 (2008-1036)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2007-4770

critical

Tenable Plugins

high

high

high

high

high

high

medium

high

high

high

high

high

high

high

high