CVE-2013-5447

published 2013-12-10

CVE-2013-5447: Stack-based buffer overflow in IBM Forms Viewer 4.x before 4.0.0.3 and 8.x before 8.0.1.1 allows remote attackers to execute arbitrary code via an XFDL form…

Priority P3 54 medium 6.8 CVSS 2.0

AV N AC M Au N C P I P A P

EXPLOIT

Stack-based buffer overflow in IBM Forms Viewer 4.x before 4.0.0.3 and 8.x before 8.0.1.1 allows remote attackers to execute arbitrary code via an XFDL form with a long fontname value.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
ibm	forms_viewer	—	—
ibm	forms_viewer	—	—
ibm	forms_viewer	—	—
ibm	forms_viewer	—	—
ibm	forms_viewer	—	—

Detection & IOCs extracted from sources · hover to see the quote

filename msf.xfdl↗

process masqform.exe↗

command mov eax, fs:[0x18] / add eax, byte 8 / mov esp, [eax] / add esp, -2000↗

other RET gadget offset 0x4c30 (p/p/r unicode) in masqform.exe↗

url http://www-01.ibm.com/support/docview.wss?uid=swg21657500↗

bytes↗

\x61\x62 (NSEH: popad + unicode-compatible NOP)

• → Detect malformed XFDL files containing an abnormally long <fontname> element value, which is the trigger for the stack-based buffer overflow in IBM Forms Viewer. ↗
• → Flag XFDL files where the <fontname> element contains alphanumeric unicode-mixed encoded shellcode (EncoderType AlphanumUnicodeMixed, BufferRegister ECX, BufferOffset 10). ↗
• → Look for the SEH overwrite pattern 0x61 0x62 (popad + unicode NOP) near offset 62 bytes into the fontname value, followed by a 2-byte little-endian RET address, as a structured exception handler exploit signature. ↗
• → Monitor masqform.exe for anomalous stack pivot activity: reading fs:[0x18]+8 into EAX then moving ESP to [EAX] and subtracting 2000 from ESP, which is the payload's stack-fix prepend sequence. ↗
• → XFDL files exploiting this CVE will carry the IBM XFDL 7.5 namespace and contain a <fontname> child of <fontinfo> inside a <label> element with payload-length content exceeding normal font name lengths (exploit appends 4096 bytes of padding). ↗
• → Bad-character filtering in the payload excludes bytes 0x00–0x08, 0x0b–0x1f, 0x26, 0x3c, and 0x80–0xff; detection signatures for this exploit should focus on the remaining printable ASCII + unicode range within the fontname value. ↗

• · The Metasploit module and its RET gadget offset (0x4c30) were tested only against IBM Forms Viewer 4.0 on Windows XP SP3 and Windows 7 SP1; the exploit target is hardcoded to a single version/platform combination. ↗
• · The vulnerability affects IBM Forms Viewer 4.x before 4.0.0.3 and 8.x before 8.0.1.1; the public exploit only targets the 4.0 branch, so 8.x detections may require different offset/gadget values. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119