Corel Presentations X5 15.0.0.357 (shw) Remote Buffer Preoccupation PoC

vendor:

Corel Presentations X5

by:

Gjoko 'LiquidWorm' Krstic

7,5

CVSS

HIGH

Remote Buffer Overflow

119

CWE

Product Name: Corel Presentations X5

Affected Version From: 15.0.0.357

Affected Version To: 15.0.0.357

Patch Exists: YES

Related CWE: N/A

CPE: a:corel:corel_presentations:15.0.0.357

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Microsoft Windows XP Pro SP3 (EN)

2010

Corel Presentations X5 15.0.0.357 (shw) Remote Buffer Preoccupation PoC

Corel WordPerfect is prone to a remote buffer overflow vulnerability because the application fails to perform adequate boundary checks on user supplied input with .SHW (Presentations Slide Show) file. Attackers may exploit this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

Mitigation:

Upgrade to the latest version of Corel WordPerfect to mitigate this vulnerability.

Source

Exploit-DB raw data:

- Title: Corel Presentations X5 15.0.0.357 (shw) Remote Buffer Preoccupation PoC
- Vendor: Corel Corporation
- Product Web Page: http://www.corel.com
- Version Tested: 15.0.0.357 (Standard Edition)

-Summary: Strengthen your visual impact. Create compelling slideshows, proposals,
demonstrations and interactive reports. Easily edit pictures, create charts and
diagrams, and share content with others. Open, edit and save MicrosoftŽ PowerPointŽ
files, including the latest OOXML (.pptx) files.

-Desc: Corel WordPerfect is prone to a remote buffer overflow vulnerability because
the application fails to perform adequate boundary checks on user supplied input with
.SHW (Presentations Slide Show) file. Attackers may exploit this issue to execute arbitrary
code in the context of the application. Failed attacks will cause denial-of-service conditions.

-Tested On: Microsoft Windows XP Pro SP3 (EN)
-Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
-liquidworm gmail com
-Zero Science Lab - http://www.zeroscience.mk
-12.07.2010

- Vendor status:

[12.07.2010] Vulnerability discovered.
[09.07.2010] Initial contact with the vendor.
[12.07.2010] No reply from vendor.
[12.07.2010] Public advisory released.

- Zero Science Lab Advisory ID: ZSL-2010-4946
- Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4946.php

- PoC:
http://www.zeroscience.mk/codes/zsl_poc17.shw.rar
or
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14346.rar (zsl_poc17.shw.rar)