Heap Out-of-Bounds Read in Antiword

Executive Summary

Antiword through 0.37 has a heap out-of-bounds read flaw in the vGet8LstInfo function within prop8.c. This occurs due to an inverted bounds check on the PlcfLst record count. Attackers exploit this by crafting a malicious Word 8 .doc file that claims up to 0xffff LSTF records while using a tiny buffer. This causes the program to read past allocated memory, crashing the process.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires analyzing files processed by antiword. Since antiword is a command-line tool, you can test it with a crafted Word document to see if it crashes. Create a test file with a high PlcfLst record count and run antiword on it. If the process crashes, the system may be vulnerable. Example command: antiword -x test.doc. Monitor for crashes or heap corruption when processing Word documents.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to crash the antiword process by supplying a specially crafted Word document. Since antiword is no longer maintained, patched versions may not be available. The crash could disrupt document processing tasks but does not appear to enable code execution or data theft based on current analysis.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes denial-of-service conditions by crashing the antiword process through heap or stack over-reads. It does not directly lead to data exfiltration or code execution, so it is unlikely to directly violate GDPR or HIPAA data confidentiality requirements. However, repeated crashes could disrupt systems processing sensitive documents, potentially impacting availability under HIPAA's Security Rule or GDPR's integrity principle.

Useful 0 Not Useful 0

Mitigation Strategies

Since antiword is no longer maintained, the best mitigation is to stop using it. Replace it with actively maintained alternatives like LibreOffice or Pandoc for document conversion. If you must use antiword, restrict its use to trusted files only and monitor for crashes. Update to the latest version if a patch becomes available, though no patch is currently confirmed.

Useful 0 Not Useful 0