CVE-2020-27247
📋 TL;DR
A heap-based buffer overflow vulnerability in SoftMaker Office PlanMaker 2021 allows attackers to execute arbitrary code by tricking victims into opening a specially crafted document. This affects users of PlanMaker 2021 revision 1014 who open malicious documents. The vulnerability stems from improper bounds checking when copying data from document records.
💻 Affected Systems
- SoftMaker Office PlanMaker 2021
📦 What is this software?
Planmaker 2021 by Softmaker
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the user opening the document, potentially leading to full system compromise, data theft, or ransomware deployment.
Likely Case
Application crash (denial of service) or limited code execution within the application context, potentially allowing further exploitation.
If Mitigated
No impact if documents are only opened from trusted sources with proper application sandboxing and least privilege principles applied.
🎯 Exploit Status
Exploitation requires user interaction (opening a malicious document) and knowledge of document structure manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Revision 1015 or later
Vendor Advisory: https://www.softmaker.com/en/security-advisory
Restart Required: Yes
Instructions:
1. Open SoftMaker Office. 2. Go to Help > Check for Updates. 3. Install available updates. 4. Restart PlanMaker.
🔧 Temporary Workarounds
Disable document macros/scripts
allConfigure PlanMaker to disable automatic execution of embedded content in documents.
Use application sandboxing
allRun PlanMaker in a restricted environment or virtual machine to limit potential damage.
🧯 If You Can't Patch
- Restrict document sources to trusted locations only
- Implement application whitelisting to prevent unauthorized PlanMaker execution
🔍 How to Verify
Check if Vulnerable:
Open PlanMaker, go to Help > About PlanMaker, check if revision is 1014.Check Version:
On Windows: wmic product where name="SoftMaker Office PlanMaker 2021" get versionVerify Fix Applied:
Verify revision is 1015 or higher in Help > About PlanMaker.📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory access violations
- Unusual document opening from untrusted sources
Network Indicators:
- Downloads of suspicious document files
SIEM Query:
source="*planmaker*" AND (event_id=1000 OR event_id=1001) AND exception_code="0xc0000005"