valitydev/signature-base
14
0
Fork 0
mirror of https://github.com/valitydev/signature-base.git synced 2024-11-06 10:05:18 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #58 from JohnLaTwC/patch-9

Browse Source 
Create gen_libre_office_CVE_2018_16858.yar
This commit is contained in:
Florian Roth 2019-02-05 19:54:33 +01:00 committed by GitHub
commit ca3960b70e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
yara/gen_libre_office_CVE_2018_16858.yar Normal file
View File

@ -0,0 +1,17 @@
rule EXP_Libre_Office_CVE_2018_16858 {
meta:
description = "RCE in Libre Office with crafted ODT file (CVE-2018-16858)"
author = "John Lambert @JohnLaTwC / modified by Florian Roth"
date = "2019-02-01"
reference = "https://insert-script.blogspot.com/2019/02/libreoffice-cve-2018-16858-remote-code.html"
hash = "95a02b70c117947ff989e3e00868c2185142df9be751a3fefe21f18fa16a1a6f"
strings:
$s1 = "xlink:href=\"vnd.sun.star.script:" ascii nocase
$s2 = ".py$tempfilepager" ascii nocase
$s3 = "language=Python" ascii nocase
$tag = {3c 6f 66 66 69 63 65 3a 64 6f 63 }
condition:
uint32be(0) == 0x3c3f786d // <?xm
and $tag in (0..0100) // <office:doc
and all of ($s*)
}