A vulnerability, which was classified as critical, was found in SoftMaker Office 2021. This affects some unknown functionality of the component PlanMaker. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-191. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

An exploitable integer overflow vulnerability exists in the PlanMaker document parsing functionality of SoftMaker Office 2021’s PlanMaker application. A specially crafted document can cause the document parser perform arithmetic that may overflow which can result in an undersized heap allocation. Later when copying data from the file into this allocation, a heap-based buffer overflow will occur which can corrupt memory. These types of memory corruptions can allow for code execution under the context of the application. An attacker can entice the victim to open a document to trigger this vulnerability.

The weakness was published 02/04/2021 as TALOS-2020-1190. The advisory is shared at talosintelligence.com. This vulnerability is uniquely identified as CVE-2020-13579 since 05/26/2020. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/23/2021).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Productinfoedit

Vendor

• SoftMaker

Name

• Office

CPE 2.3infoedit

• 🔒

CPE 2.2infoedit

• 🔒

CVSSv3infoedit

CVSSv2infoedit

Exploitinginfoedit

Threat Intelligenceinfoedit

Countermeasuresinfoedit

Timelineinfoedit

Sourcesinfoedit

Entryinfoedit

Comments