Summary

Overflow occurs due to insufficient validation for the length of hyperlink data when processing Word NEO (*.hwdt) file format
This allows an attacker to bypass protection module in the application and could remotely execute an arbitrary code

Vulnerability Type	Influences	Severity	CVE ID
Buffer Overflow	Remote Code Execution	Critical	CVE-2018-5195

Thinkfree Office NEO (Word NEO) 9.6.1.5183 and earlier

Word processes a file format in Word\_rels\document.xml.rels. Word does not validate the length of data for Target field and this leads an overflow to occur if the Relationships tag type property is Hyperlink in the file
- Word copies hyperlink data from MakeHyperlinkTooltip function in "{Thinkfree Office path}\Bin\HwordApp.dee" when displaying hyperlink tooltips in a document
- At this point, overflow occurs if a data greater than 260 bytes is entered because the size of the variable dzDecodeURL, which is receive the data, is fixed as 260 bytes (0x104)

An attacker could execute a remote code by maliciously modifying a virtual function pointer nearby szDecodeURL
- An attacker then refers 1109AFA0 (where overflows occrus, 11099FD8 + 0xFC8) in which the virtual function pointer is saved at HwordApp.dll+00043BBA
- An attacker moves 1109AFA0 value to EAX register and CALL to the location at which "EAX+10" pointer indicates
- Word has a protection module for an vulnerability but its ASLR is limited so an attacker configures ROP using SDSerialize.dll gadget with no ASLR option applied, and could unload and bypass it with Freelibrary API

Recommend to update to the latest version released after 11st July, 2017

Fixed Versions

	Version	Details	Operating System
Common Components	9.6.1.7461	Fixed minor errors in Real-time Malware Block functionality	Windows 7/8/10
TF Word NEO	9.6.1.5495	Improved #50 security vulnerabilities.	Windows 7/8/10

Thanks to Giwan Go of Stealien Inc. for reporting this vulnerability through
KrCERT/CC's Vulnerability Report Reward System.

Technical Support

If you have any inconvenience using Thinkfree Office or if you want to send us your feedback, please contact us by using the information below.
Your voice makes us move forward. We will do our utmost to improve the quality of our products with you.

Direct Mail	Hancom Tower, 49 Daewangpangyo-ro 644 Beon-gil, Sampyeong-dong Bundang-gu, Seongnam-si, Gyeonggi-do, Republic of Korea, 13493
e-Mail	suppor@thinkfree.com
Website	Hancom Inc. Official Website (www.hancom.com)