Heap Out-of-Bounds Read in ytnef

Executive Summary

This vulnerability is a heap out-of-bounds read in ytnef 2.1.2's DecompressRTF() function in lib/ytnef.c. It occurs when processing compressed RTF data in winmail.dat files. The function reads an uncompressedSize value directly from attacker-controlled input without validating it against the actual data size. This leads to a memcpy operation reading beyond the intended buffer, causing a heap overflow. Attackers can exploit this by crafting a malicious PT_BINARY MAPI property to crash applications or leak heap memory.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect systems running ytnef 2.1.2 or earlier for crashes when processing winmail.dat files. Use AddressSanitizer or libFuzzer builds to identify heap out-of-bounds reads in DecompressRTF() or MAPIPrint(). Monitor logs for crashes in ytnefprint or applications using libytnef.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing applications using ytnef (like ytnefprint) to crash when processing malicious winmail.dat files. It may also leak sensitive data from adjacent memory locations. While arbitrary code execution is possible, it requires specific conditions and is not guaranteed. The impact is higher for users who frequently handle TNEF attachments from untrusted sources.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update ytnef to a patched version beyond 2.1.2. If updating is not possible, disable processing of winmail.dat files or block TNEF attachments at the email gateway. Avoid using ytnefprint on untrusted files until patched.

Useful 0 Not Useful 0