CVE-2017-9433
📋 TL;DR
CVE-2017-9433 is a critical heap-based buffer overflow vulnerability in libmwaw, a library for parsing legacy Microsoft Word documents. Exploitation allows arbitrary code execution with the privileges of the application using the library. Affected systems include any software that uses vulnerable versions of libmwaw to process untrusted Word documents.
💻 Affected Systems
- libmwaw
- software using libmwaw (like LibreOffice, AbiWord)
📦 What is this software?
Libmwaw by Libmwaw Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Arbitrary code execution when processing malicious Word documents, potentially leading to malware installation or data exfiltration.
If Mitigated
Limited impact if proper input validation and memory protections are enabled, potentially causing only application crashes.
🎯 Exploit Status
Proof-of-concept available via OSS-Fuzz. Exploitation requires user to open malicious document.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: libmwaw version from 2017-04-08 or later
Vendor Advisory: https://sourceforge.net/p/libmwaw/libmwaw/ci/68b3b74569881248bfb6cbb4266177cc253b292f/
Restart Required: Yes
Instructions:
1. Update libmwaw to version from 2017-04-08 or later. 2. Update dependent applications. 3. Restart affected services.
🔧 Temporary Workarounds
Disable libmwaw document processing
allConfigure applications to not use libmwaw for parsing Word documents
Application-specific configuration required
Enable ASLR and DEP
linux/windowsUse operating system memory protection features
sudo sysctl -w kernel.randomize_va_space=2
Enable DEP in Windows security settings
🧯 If You Can't Patch
- Block Word document uploads/processing at network perimeter
- Implement application whitelisting to prevent unauthorized code execution
🔍 How to Verify
Check if Vulnerable:
Check libmwaw version: dpkg -l | grep libmwaw or rpm -qa | grep libmwawCheck Version:
dpkg -l | grep libmwaw # Debian/Ubuntu
rpm -qa | grep libmwaw # RHEL/CentOS
pkg info libmwaw # FreeBSDVerify Fix Applied:
Verify version is from 2017-04-08 or later: libmwaw --version📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing Word documents
- Memory access violation errors
Network Indicators:
- Unusual outbound connections after document processing
- Document uploads to vulnerable services
SIEM Query:
source="application.log" AND ("segmentation fault" OR "buffer overflow") AND "libmwaw"🔗 References
- http://www.debian.org/security/2017/dsa-3875
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1037
- https://sourceforge.net/p/libmwaw/libmwaw/ci/68b3b74569881248bfb6cbb4266177cc253b292f/
- http://www.debian.org/security/2017/dsa-3875
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1037
- https://sourceforge.net/p/libmwaw/libmwaw/ci/68b3b74569881248bfb6cbb4266177cc253b292f/
