Heap Out-of-Bounds Read in ytnef via MAPIPrint

Executive Summary

ytnef through version 2.1.2 has a heap out-of-bounds read vulnerability in the MAPIPrint() function. Attackers can exploit this by providing compressed RTF properties in a crafted winmail.dat file. If the decompressed RTF data lacks a NUL terminator, printf over-reads memory, causing ytnefprint to crash and leak adjacent heap bytes.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if ytnef version 2.1.2 or earlier is installed on your system. Run 'ytnef --version' to verify the version. If vulnerable, test processing a crafted winmail.dat file with 'ytnefprint' to observe crashes or heap leaks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to read sensitive data stored in adjacent memory locations. It may cause crashes in ytnefprint and potentially expose confidential information. Systems processing untrusted winmail.dat files are at risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts data confidentiality by allowing attackers to read adjacent heap memory contents through crafted winmail.dat files. For GDPR, it could lead to unauthorized data exposure if sensitive personal data is leaked. HIPAA compliance may be affected if protected health information is exposed due to the heap over-read. The vulnerability's impact depends on the specific data processed by the affected system.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade ytnef to a version beyond 2.1.2 immediately. If upgrading is not possible, avoid processing untrusted winmail.dat files with ytnef tools. Monitor system logs for crashes in ytnefprint as a potential indicator of exploitation.

Useful 0 Not Useful 0