CVE-2020-18897
📋 TL;DR
This use-after-free vulnerability in libpff allows attackers to cause denial of service or execute arbitrary code by processing a malicious PFF (Personal Folder File) file. It affects any application that uses vulnerable versions of libpff to parse Outlook PST/OST files. Users and systems processing untrusted PFF files are at risk.
💻 Affected Systems
- libyal libpff
📦 What is this software?
Libpff by Libpff Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the application using libpff, potentially leading to full system compromise.
Likely Case
Application crash causing denial of service, potentially corrupting data being processed.
If Mitigated
Limited to denial of service if memory protections like ASLR are enabled, but still disruptive.
🎯 Exploit Status
Exploitation requires crafting a malicious PFF file and getting it processed by vulnerable software. Proof-of-concept exists in GitHub issues.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 20180623 and later
Vendor Advisory: https://github.com/libyal/libpff/issues/61
Restart Required: No
Instructions:
1. Update libpff to version 20180623 or later. 2. Recompile any applications using libpff. 3. Replace existing libpff libraries with patched version.
🔧 Temporary Workarounds
Restrict PFF file processing
allLimit processing of PFF files to trusted sources only
Use memory protection controls
linuxEnable ASLR and other memory protection mechanisms
echo 2 > /proc/sys/kernel/randomize_va_space
🧯 If You Can't Patch
- Isolate systems using libpff from processing untrusted files
- Implement strict file validation and sandboxing for PFF processing
🔍 How to Verify
Check if Vulnerable:
Check libpff version: pffinfo --version or check library version in /usr/lib/Check Version:
pffinfo --version 2>/dev/null || strings /usr/lib/libpff* | grep -i versionVerify Fix Applied:
Verify version is 20180623 or later and test with known malicious PFF files📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing PFF files
- Memory access violation errors in application logs
Network Indicators:
- Unusual file uploads with .pst/.ost extensions
- Network transfers of PFF files to analysis systems
SIEM Query:
source="application.log" AND ("segmentation fault" OR "access violation") AND ("pff" OR "pst" OR "ost")