面向RTF的OLE对象漏洞分析研究

乐德广; 章亮; 龚声蓉; 郑力新; 吴少刚

doi:10.11959/j.issn.2096-109x.2016.00011

您当前的位置：

首页 >

文章列表页 >

面向RTF的OLE对象漏洞分析研究

学术论文 | 更新时间：2024-06-03

- 面向RTF的OLE对象漏洞分析研究
- Research on OLE object vulnerability analysis for RTF file
- 网络与信息安全学报 2016年2卷第1期页码：34-45
- 作者机构：
  
  1. 常熟理工学院计算机科学与工程学院，江苏常熟 215500
  2. 苏州大学计算机科学与技术学院，江苏苏州 215006
  3. 华侨大学工学院，福建泉州 362021
  4. 江苏中科梦兰电子科技有限公司，江苏常熟 215500
- 作者简介：
  
  [ "乐德广（1975-），男，福建三明人，博士，常熟理工学院计算机科学与工程学院副教授，主要研究方向为计算机网络安全与下一代互联网技术等。" ]
  [ "章亮（1990-），男，安徽合肥人，华侨大学硕士生，主要研究方向为信息安全与网络攻防等。" ]
  [ "龚声蓉（1966-），男，江苏苏州人，博士，常熟理工学院计算机科学与工程学院教授，主要研究方向为图像处理与信息安全等。" ]
  [ "郑力新（1967-），男，福建泉州人，华侨大学教授，主要研究方向为图像处理与信息安全等。" ]
  [ "吴少刚（1973-），男，安徽宿松人，博士，主要研究方向为计算机系统安全、结构，并行与分布式计算等。" ]
- 基金信息：
  
  国家自然科学基金资助项目;The National Natural Science Foundation of China(61202440);国家自然科学基金资助项目;The National Natural Science Foundation of China(61170124);国家自然科学基金资助项目;The National Natural Science Foundation of China(61402057);福建省物联网云计算平台建设基金资助项目;TFujian Internet of Things and Cloud Computing Program(2013H2002)
- DOI：10.11959/j.issn.2096-109x.2016.00011
  中图分类号： TP393
- 网络首发：2016-01，
  
  纸质出版：2016-01-15
- 稿件说明：
移动端阅览
乐德广, 章亮, 龚声蓉, 等. 面向RTF的OLE对象漏洞分析研究[J]. 网络与信息安全学报, 2016,2(1):34-45.

De-guang LE, Liang ZHANG, Sheng-rong GONG, et al. Research on OLE object vulnerability analysis for RTF file[J]. Chinese Journal of Network and Information Security, 2016, 2(1): 34-45.
乐德广, 章亮, 龚声蓉, 等. 面向RTF的OLE对象漏洞分析研究[J]. 网络与信息安全学报, 2016,2(1):34-45. DOI： 10.11959/j.issn.2096-109x.2016.00011.

De-guang LE, Liang ZHANG, Sheng-rong GONG, et al. Research on OLE object vulnerability analysis for RTF file[J]. Chinese Journal of Network and Information Security, 2016, 2(1): 34-45. DOI： 10.11959/j.issn.2096-109x.2016.00011.

摘要

摘要：针对RTF文档在OLE对象解析过程中出现的安全漏洞问题，提出了一种基于数据块解析及特征数据构造的OLE对象漏洞分析方法。利用逆向技术分析OLE对象漏洞的触发条件，通过数据块解析定位OLE对象漏洞的触发点，并基于特征数据构造检测OLE对象漏洞。实验表明，该方法不但能正确检测出RTF的OLE对象漏洞，而且能精准定位漏洞触发点，为研究漏洞补丁提供有效依据。此外，与现有方法相比，该方法还具有更高的检测效果，从而有效防御各种面向RTF文档的OLE对象漏洞利用攻击。

Abstract

In order to deal with the problem of OLE parsing vulnerability for RTF documents

a kind of vulnerability analysis method based on data block analysis and characterization data construction was proposed. The trigger con-ditions of OLE object vulnerability by reverse engineering technique were analyzed. The trigger point of vulnerabil-ity was located through data block analysis. The OLE object vulnerability was detected based on characterization data construction. Tests show that the proposed method not only detects the OLE object vulnerability correctly

but also locates the point of vulnerability accurately

which provides the effective support for the research on vulnerabil-ity patches. Besides

the detection effectiveness of the proposed method is higher than that of other methods

which can effectively defense the exploit attack of OLE object vulnerability for RTF documents.

关键词

Keywords

references

NAGARAJU S S , CRAIOVEANU C , FLORIO E , et al . Software vulnerability exploitation trends [R ] . 2013 .

吴世忠 , 郭涛 , 董国伟 , 等 . 软件漏洞分析技术进展 [J ] . 清华大学学报（自然科学版）, 2012 , 52 ( 10 ): 1309 - 1319 .

WU S Z , GUO T , DONG G W , et al . Software vulnerability analy-sis: a road map [J ] . Journal of Tsinghua University （ Science and Technology ）, 2012 , 52 ( 10 ): 1309 - 1319 .

杨丁宁 , 肖晖 , 张玉清 , 等 . 基于fuzzing的ActiveX控件漏洞挖掘技术研究 [J ] . 计算机研究与发展 , 2012 , 49 ( 7 ): 1525 - 1532 .

YANG D N , XIAO H , ZHANG Y Q , et al . Vulnerability detection in ActiveX controls based on Fuzzing technology [J ] . Journal of Computer Research and Development , 2012 , 49 ( 7 ): 1525 - 1532 .

刘奇旭 , 温涛 , 闻观行 , 等 . Flash跨站脚本漏洞挖掘技术研究 [J ] . 计算机研究与发展 2014 , 51 ( 7 ): 1624 - 1632 .

LIU Q X , WEN T , WEN G X , et al . Detection of XSS vulnerabili-ties in online flash [J ] . Journal of Computer Research and Devel-opment , 2014 , 51 ( 7 ): 1624 - 1632 .

REBERT A , CHA S K , AVGERINOS T , et al . Optimizing seed selection for Fuzzing [C ] // The 23rd USENIX Security Symposium, San Diego . 2014 : 861 - 875 .

史飞悦 , 傅德胜 . 缓冲区溢出漏洞挖掘分析及利用的研究 [J ] . 计算机科学 2013 , 40 ( 11 ): 143 - 146 .

SHI F Y , FU D S . Research of buffer overflow vulnerability dis-covering analysis and exploiting [J ] . Computer Science , 2013 , 40 ( 11 ): 143 - 146 .

乐德广 , 章亮 , 郑力新 , 等 . 面向RTF文件的Word漏洞分析 [J ] . 华侨大学学报（自然科学版）, 2015 , 36 ( 1 ): 17 - 22 .

LE D G , ZHANG L , ZHENG L X , et al Research on word vulner-ability analysis for the RTF file [J ] . Journal of Huaqiao University （ Natural Science ）, 2015 , 36 ( 1 ): 17 - 22 .

LEATHERY J . Microsoft office zero day CVE-2015-2424 [EB/OL ] . http://www.isightpartners.com/2015/07/microsoft-office-zero-day-cve-2015-2424-leveraged-by-tsar-team/ http://www.isightpartners.com/2015/07/microsoft-office-zero-day-cve-2015-2424-leveraged-by-tsar-team/ .

LI H F , SUN B . Attacking interoperability: an OLE edition [EB/OL ] . https://www.blackhat.com/docs/us-15/materials/us-15-Li-Attacking-Interoperability-An-OLE-Edition.pdf https://www.blackhat.com/docs/us-15/materials/us-15-Li-Attacking-Interoperability-An-OLE-Edition.pdf .

MICROSOFT . OLE concepts and requirements overview [EB/OL ] . https://support.microsoft.com/en-us/kb/86008 https://support.microsoft.com/en-us/kb/86008 .

MICROSOFT . The microsoft office visualization tool (OffVis) [EB/OL ] . http://www.microsoft.com/en-us/download/details.aspx?id=2096 http://www.microsoft.com/en-us/download/details.aspx?id=2096 .

MICROSOFT . Rich text format (RTF) specification version 1.9.1 [J ] . 2008 .

MICROSOFT . Microsoft security bulletin MS12-060 [EB/OL ] . https://technet.microsoft.com/en-us/library/security/ms12-060 https://technet.microsoft.com/en-us/library/security/ms12-060 .

MICROSOFT . Microsoft security bulletin MS12-027 [EB/OL ] . https://technet.microsoft.com/en-us/library/security/ms12-027.aspx https://technet.microsoft.com/en-us/library/security/ms12-027.aspx .

MICROSOFT . Microsoft security bulletin MS13-096 [EB/OL ] . https://technet.microsoft.com/en-us/library/security/ms13-096.aspx https://technet.microsoft.com/en-us/library/security/ms13-096.aspx .

王明华 , 应凌云 , 冯登国 . 基于异常控制流识别的漏洞利用攻击检测方法 [J ] . 通信学报 , 2014 , 35 ( 9 ): 20 - 31 .

WANG M H , YING L Y , FENG D G . Exploit detection based on illegal control flow transfers identification [J ] . Journal on Communications , 2014 , 35 ( 9 ): 20 - 31 .

HUND R , WILLENS C , HOLZ T . Practical timing side channel attacks against kernel space ASLR [C ] // IEEE Symposium on Security and Pri-vacy (SP). Berkeley ,c 2013 : 191 - 205 .

BOLDEWIN F . OfficeMalScanner/RTFScan [EB/OL ] . http://www.reconstructer.org/ http://www.reconstructer.org/ .

BONFA G E . PyOLEScanner [EB/OL ] . http://www.aldeid.com/wiki/PyOLEScanner http://www.aldeid.com/wiki/PyOLEScanner .

X-WAYS AG . WinHex hex editor [EB/OL ] . http://www.winhex.com/winhex/hex-editor.html http://www.winhex.com/winhex/hex-editor.html .

MICROSOFT . Debugging tools for windows [EB/OL ] . https://msdn.microsoft.com/en-us/library/ff551063.aspx https://msdn.microsoft.com/en-us/library/ff551063.aspx .

PARKOUR M . Malicious files for signature testing and research [EB/OL ] . http://contagiodump.blogspot.de/2013/03/16800-clean-and-11960-malicious-files.html http://contagiodump.blogspot.de/2013/03/16800-clean-and-11960-malicious-files.html .

浏览量

5500

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

进程控制流劫持攻击与防御技术综述

基于函数语义分析的软件补丁比对技术

代码复用对抗技术研究进展

基于软硬件协同形式验证的固件漏洞分析技术