Peter M. Groen / oletools

Commit 932d24693c9ca839921b1131910476fef3dfe816

Authored by decalage2
1 parent 26f83bf4

rtfobj: added detection of the OLE2Link vulnerability

Inline Side-by-side
Showing 1 changed file with 9 additions and 2 deletions
oletools/rtfobj.py
  View file @932d246
@@ -69,8 +69,9 @@ http://www.decalage.info/python/oletools @@ -69,8 +69,9 @@ http://www.decalage.info/python/oletools
69 # - fixed hex decoding bug in RtfObjParser (issue #103) 69 # - fixed hex decoding bug in RtfObjParser (issue #103)
70 # 2017-03-29 PL: - fixed RtfParser to handle issue #152 (control word with 70 # 2017-03-29 PL: - fixed RtfParser to handle issue #152 (control word with
71 # long parameter) 71 # long parameter)
  72 +# 2017-04-11 PL: - added detection of the OLE2Link vulnerability
72 73
73 -__version__ = '0.51dev4' 74 +__version__ = '0.51dev5'
74 75
75 # ------------------------------------------------------------------------------ 76 # ------------------------------------------------------------------------------
76 # TODO: 77 # TODO:
@@ -692,6 +693,7 @@ def process_file(container, filename, data, output_dir=None, save_object=False): @@ -692,6 +693,7 @@ def process_file(container, filename, data, output_dir=None, save_object=False):
692 rtfp = RtfObjParser(data) 693 rtfp = RtfObjParser(data)
693 rtfp.parse() 694 rtfp.parse()
694 for rtfobj in rtfp.objects: 695 for rtfobj in rtfp.objects:
  696 + ole_color = None
695 pkg_color = None 697 pkg_color = None
696 if rtfobj.is_ole: 698 if rtfobj.is_ole:
697 ole_column = 'format_id: %d\n' % rtfobj.format_id 699 ole_column = 'format_id: %d\n' % rtfobj.format_id
@@ -710,6 +712,11 @@ def process_file(container, filename, data, output_dir=None, save_object=False): @@ -710,6 +712,11 @@ def process_file(container, filename, data, output_dir=None, save_object=False):
710 pkg_column += '\nEXECUTABLE FILE' 712 pkg_column += '\nEXECUTABLE FILE'
711 else: 713 else:
712 pkg_column = 'Not an OLE Package' 714 pkg_column = 'Not an OLE Package'
  715 + # Detect OLE2Link exploit
  716 + # http://www.kb.cert.org/vuls/id/921560
  717 + if rtfobj.class_name == 'OLE2Link':
  718 + ole_color = 'red'
  719 + ole_column += '\nPossibly an exploit for the OLE2Link vulnerability (VU#921560, CVE-2017-TODO)'
713 else: 720 else:
714 pkg_column = '' 721 pkg_column = ''
715 ole_column = 'Not a well-formed OLE object' 722 ole_column = 'Not a well-formed OLE object'
@@ -719,7 +726,7 @@ def process_file(container, filename, data, output_dir=None, save_object=False): @@ -719,7 +726,7 @@ def process_file(container, filename, data, output_dir=None, save_object=False):
719 '%08Xh' % rtfobj.start, 726 '%08Xh' % rtfobj.start,
720 ole_column, 727 ole_column,
721 pkg_column 728 pkg_column
722 - ), colors=(None, None, None, pkg_color) 729 + ), colors=(None, None, ole_color, pkg_color)
723 ) 730 )
724 tstream.write_sep() 731 tstream.write_sep()
725 if save_object: 732 if save_object: