Out-of-Bounds Read in catdoc via Malformed XLS Files

Executive Summary

This vulnerability is an out-of-bounds read flaw in catdoc version 0.95 or earlier. It occurs in the copy_unicode_string() function in src/xlsparse.c where string character counts are not properly checked. Attackers can create a malicious .xls file with LABEL, STRING, or SST records declaring 0xFFFF two-byte characters. This causes the program to read past allocated memory buffers during processing by xls2csv, potentially exposing adjacent memory or crashing the application.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if catdoc version 0.95 or earlier is installed on your system. Run 'catdoc -v' or 'dpkg -l | grep catdoc' on Debian-based systems to verify the version. If vulnerable, the output will show version 0.95 or lower.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to read sensitive memory data from your system through crafted .xls files. If you process untrusted Excel files using catdoc, an attacker might extract confidential information or cause the program to crash. The impact is limited to systems running vulnerable versions of catdoc (0.95 or earlier) when handling malicious files.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles if personal data is leaked. For HIPAA, it may compromise protected health information if medical data is involved. Organizations using vulnerable catdoc versions must address this flaw to maintain compliance with data protection regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update catdoc to the latest version beyond 0.95. If no patch is available, avoid processing untrusted .xls files with catdoc or xls2csv. Use alternative tools like LibreOffice for file conversion until patched.

Useful 0 Not Useful 0