Peter M. Groen / oletools

Commit 932d24693c9ca839921b1131910476fef3dfe816

Authored by decalage2
1 parent 26f83bf4

rtfobj: added detection of the OLE2Link vulnerability

Inline Side-by-side
Showing 1 changed file with 9 additions and 2 deletions
oletools/rtfobj.py
  View file @932d246
... ... @@ -69,8 +69,9 @@ http://www.decalage.info/python/oletools
69 69 # - fixed hex decoding bug in RtfObjParser (issue #103)
70 70 # 2017-03-29 PL: - fixed RtfParser to handle issue #152 (control word with
71 71 # long parameter)
  72 +# 2017-04-11 PL: - added detection of the OLE2Link vulnerability
72 73  
73   -__version__ = '0.51dev4'
  74 +__version__ = '0.51dev5'
74 75  
75 76 # ------------------------------------------------------------------------------
76 77 # TODO:
... ... @@ -692,6 +693,7 @@ def process_file(container, filename, data, output_dir=None, save_object=False):
692 693 rtfp = RtfObjParser(data)
693 694 rtfp.parse()
694 695 for rtfobj in rtfp.objects:
  696 + ole_color = None
695 697 pkg_color = None
696 698 if rtfobj.is_ole:
697 699 ole_column = 'format_id: %d\n' % rtfobj.format_id
... ... @@ -710,6 +712,11 @@ def process_file(container, filename, data, output_dir=None, save_object=False):
710 712 pkg_column += '\nEXECUTABLE FILE'
711 713 else:
712 714 pkg_column = 'Not an OLE Package'
  715 + # Detect OLE2Link exploit
  716 + # http://www.kb.cert.org/vuls/id/921560
  717 + if rtfobj.class_name == 'OLE2Link':
  718 + ole_color = 'red'
  719 + ole_column += '\nPossibly an exploit for the OLE2Link vulnerability (VU#921560, CVE-2017-TODO)'
713 720 else:
714 721 pkg_column = ''
715 722 ole_column = 'Not a well-formed OLE object'
... ... @@ -719,7 +726,7 @@ def process_file(container, filename, data, output_dir=None, save_object=False):
719 726 '%08Xh' % rtfobj.start,
720 727 ole_column,
721 728 pkg_column
722   - ), colors=(None, None, None, pkg_color)
  729 + ), colors=(None, None, ole_color, pkg_color)
723 730 )
724 731 tstream.write_sep()
725 732 if save_object:
... ...