Research on OLE object vulnerability analysis for RTF file

De-guang LE; Liang ZHANG; Sheng-rong GONG; Li-xin ZHENG; Shao-gang WU

doi:10.11959/j.issn.2096-109x.2016.00011

您当前的位置：

首页 >

文章列表页 >

Research on OLE object vulnerability analysis for RTF file

Papers | 更新时间：2024-06-03

- Research on OLE object vulnerability analysis for RTF file
- Chinese Journal of Network and Information Security Vol. 2, Issue 1, Pages: 34-45(2016)
- 作者机构：
  
  1. 常熟理工学院计算机科学与工程学院，江苏常熟 215500
  2. 苏州大学计算机科学与技术学院，江苏苏州 215006
  3. 华侨大学工学院，福建泉州 362021
  4. 江苏中科梦兰电子科技有限公司，江苏常熟 215500
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2016.00011
  CLC： TP393
- Online First：2016-01，
  
  Published：15 January 2016
- 稿件说明：
移动端阅览
De-guang LE, Liang ZHANG, Sheng-rong GONG, et al. Research on OLE object vulnerability analysis for RTF file[J]. Chinese Journal of Network and Information Security, 2016, 2(1): 34-45.
DOI：

De-guang LE, Liang ZHANG, Sheng-rong GONG, et al. Research on OLE object vulnerability analysis for RTF file[J]. Chinese Journal of Network and Information Security, 2016, 2(1): 34-45. DOI： 10.11959/j.issn.2096-109x.2016.00011.

摘要

摘要：针对RTF文档在OLE对象解析过程中出现的安全漏洞问题，提出了一种基于数据块解析及特征数据构造的OLE对象漏洞分析方法。利用逆向技术分析OLE对象漏洞的触发条件，通过数据块解析定位OLE对象漏洞的触发点，并基于特征数据构造检测OLE对象漏洞。实验表明，该方法不但能正确检测出RTF的OLE对象漏洞，而且能精准定位漏洞触发点，为研究漏洞补丁提供有效依据。此外，与现有方法相比，该方法还具有更高的检测效果，从而有效防御各种面向RTF文档的OLE对象漏洞利用攻击。

Abstract

In order to deal with the problem of OLE parsing vulnerability for RTF documents

a kind of vulnerability analysis method based on data block analysis and characterization data construction was proposed. The trigger con-ditions of OLE object vulnerability by reverse engineering technique were analyzed. The trigger point of vulnerabil-ity was located through data block analysis. The OLE object vulnerability was detected based on characterization data construction. Tests show that the proposed method not only detects the OLE object vulnerability correctly

but also locates the point of vulnerability accurately

which provides the effective support for the research on vulnerabil-ity patches. Besides

the detection effectiveness of the proposed method is higher than that of other methods

which can effectively defense the exploit attack of OLE object vulnerability for RTF documents.

关键词

Keywords

references

NAGARAJU S S , CRAIOVEANU C , FLORIO E , et al . Software vulnerability exploitation trends [R ] . 2013 .

吴世忠 , 郭涛 , 董国伟 , 等 . 软件漏洞分析技术进展 [J ] . 清华大学学报（自然科学版）, 2012 , 52 ( 10 ): 1309 - 1319 .

WU S Z , GUO T , DONG G W , et al . Software vulnerability analy-sis: a road map [J ] . Journal of Tsinghua University （ Science and Technology ）, 2012 , 52 ( 10 ): 1309 - 1319 .

杨丁宁 , 肖晖 , 张玉清 , 等 . 基于fuzzing的ActiveX控件漏洞挖掘技术研究 [J ] . 计算机研究与发展 , 2012 , 49 ( 7 ): 1525 - 1532 .

YANG D N , XIAO H , ZHANG Y Q , et al . Vulnerability detection in ActiveX controls based on Fuzzing technology [J ] . Journal of Computer Research and Development , 2012 , 49 ( 7 ): 1525 - 1532 .

刘奇旭 , 温涛 , 闻观行 , 等 . Flash跨站脚本漏洞挖掘技术研究 [J ] . 计算机研究与发展 2014 , 51 ( 7 ): 1624 - 1632 .

LIU Q X , WEN T , WEN G X , et al . Detection of XSS vulnerabili-ties in online flash [J ] . Journal of Computer Research and Devel-opment , 2014 , 51 ( 7 ): 1624 - 1632 .

REBERT A , CHA S K , AVGERINOS T , et al . Optimizing seed selection for Fuzzing [C ] // The 23rd USENIX Security Symposium, San Diego . 2014 : 861 - 875 .

史飞悦 , 傅德胜 . 缓冲区溢出漏洞挖掘分析及利用的研究 [J ] . 计算机科学 2013 , 40 ( 11 ): 143 - 146 .

SHI F Y , FU D S . Research of buffer overflow vulnerability dis-covering analysis and exploiting [J ] . Computer Science , 2013 , 40 ( 11 ): 143 - 146 .

乐德广 , 章亮 , 郑力新 , 等 . 面向RTF文件的Word漏洞分析 [J ] . 华侨大学学报（自然科学版）, 2015 , 36 ( 1 ): 17 - 22 .

LE D G , ZHANG L , ZHENG L X , et al Research on word vulner-ability analysis for the RTF file [J ] . Journal of Huaqiao University （ Natural Science ）, 2015 , 36 ( 1 ): 17 - 22 .

LEATHERY J . Microsoft office zero day CVE-2015-2424 [EB/OL ] . http://www.isightpartners.com/2015/07/microsoft-office-zero-day-cve-2015-2424-leveraged-by-tsar-team/ http://www.isightpartners.com/2015/07/microsoft-office-zero-day-cve-2015-2424-leveraged-by-tsar-team/ .

LI H F , SUN B . Attacking interoperability: an OLE edition [EB/OL ] . https://www.blackhat.com/docs/us-15/materials/us-15-Li-Attacking-Interoperability-An-OLE-Edition.pdf https://www.blackhat.com/docs/us-15/materials/us-15-Li-Attacking-Interoperability-An-OLE-Edition.pdf .

MICROSOFT . OLE concepts and requirements overview [EB/OL ] . https://support.microsoft.com/en-us/kb/86008 https://support.microsoft.com/en-us/kb/86008 .

MICROSOFT . The microsoft office visualization tool (OffVis) [EB/OL ] . http://www.microsoft.com/en-us/download/details.aspx?id=2096 http://www.microsoft.com/en-us/download/details.aspx?id=2096 .

MICROSOFT . Rich text format (RTF) specification version 1.9.1 [J ] . 2008 .

MICROSOFT . Microsoft security bulletin MS12-060 [EB/OL ] . https://technet.microsoft.com/en-us/library/security/ms12-060 https://technet.microsoft.com/en-us/library/security/ms12-060 .

MICROSOFT . Microsoft security bulletin MS12-027 [EB/OL ] . https://technet.microsoft.com/en-us/library/security/ms12-027.aspx https://technet.microsoft.com/en-us/library/security/ms12-027.aspx .

MICROSOFT . Microsoft security bulletin MS13-096 [EB/OL ] . https://technet.microsoft.com/en-us/library/security/ms13-096.aspx https://technet.microsoft.com/en-us/library/security/ms13-096.aspx .

王明华 , 应凌云 , 冯登国 . 基于异常控制流识别的漏洞利用攻击检测方法 [J ] . 通信学报 , 2014 , 35 ( 9 ): 20 - 31 .

WANG M H , YING L Y , FENG D G . Exploit detection based on illegal control flow transfers identification [J ] . Journal on Communications , 2014 , 35 ( 9 ): 20 - 31 .

HUND R , WILLENS C , HOLZ T . Practical timing side channel attacks against kernel space ASLR [C ] // IEEE Symposium on Security and Pri-vacy (SP). Berkeley ,c 2013 : 191 - 205 .

BOLDEWIN F . OfficeMalScanner/RTFScan [EB/OL ] . http://www.reconstructer.org/ http://www.reconstructer.org/ .

BONFA G E . PyOLEScanner [EB/OL ] . http://www.aldeid.com/wiki/PyOLEScanner http://www.aldeid.com/wiki/PyOLEScanner .

X-WAYS AG . WinHex hex editor [EB/OL ] . http://www.winhex.com/winhex/hex-editor.html http://www.winhex.com/winhex/hex-editor.html .

MICROSOFT . Debugging tools for windows [EB/OL ] . https://msdn.microsoft.com/en-us/library/ff551063.aspx https://msdn.microsoft.com/en-us/library/ff551063.aspx .

PARKOUR M . Malicious files for signature testing and research [EB/OL ] . http://contagiodump.blogspot.de/2013/03/16800-clean-and-11960-malicious-files.html http://contagiodump.blogspot.de/2013/03/16800-clean-and-11960-malicious-files.html .

Views

5500

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Overview of control-flow hijacking attack and defense techniques for process

Software patch comparison technology through semantic analysis on function

Research progress in code reuse attacking and defending

Firmware vulnerability analysis based on formal verification of software and hardware

Related Author

Fengfeng WANG

Tao ZHANG

Weiguang XU

Meng SUN

Yan CAO

Long LIU

Yu WANG

Qingxian WANG

Related Institution

State Key Laboratory of Mathematical Engineering ＆Advanced Computing

Henan University of Engineering

Information and Navigation College, Air Force Engineering University

Department of Computer Science and Technology,Peking University

Jiangnan Institute of Computing Technology

⁰