Link Grammar "separate_sentence()" Buffer Overflow
8 Nov. 2007
Summary
The Link Grammar Parser is "a syntactic parser of English, based on link grammar, an original theory of English syntax. Given a sentence, the system assigns to it a syntactic structure, which consists of a set of labeled links connecting pairs of words. The parser also produces a "constituent" representation of a sentence (showing noun phrases, verb phrases, etc.)" Secunia Research has discovered a vulnerability in Link Grammar, which can be exploited by malicious people to compromise an application using the affected code.
The vulnerability is caused due to a boundary error within the "separate_word()" function in tokenize.c when processing overly long words (over 61 bytes). This can be exploited to cause a stack-based buffer overflow via a specially crafted sentence passed to the "separate_sentence()" function.
Successful exploitation allows execution of arbitrary code.
Time Table:
23/10/2007 - Vendor notified.
07/11/2007 - Public disclosure.
