Executive brief
Open Babel is a widely used software library for converting and viewing chemical data files. A security flaw in how it processes certain scientific file formats (Gaussian) allows an attacker to crash the software or potentially take control of the system by providing a specially crafted, malicious file. This is particularly significant for organizations running web-based chemical converters or molecular modeling tools that use this library to process user-uploaded data.
Technical details
An out-of-bounds write vulnerability exists in Open Babel's Gaussian format orientation functionality within 'formats/gaussformat.cpp'. The root cause is located in the 'ReadMolecule' function, where a fixed-size stack buffer ('coords_type' of 25 bytes) is used to store tokens from the input file. The code uses 'strncpy' to copy up to 24 bytes into this buffer and subsequently uses 'strcat' to append a 13-character fixed string (' orientation:'), resulting in a stack-based buffer overflow. An attacker can exploit this by providing a malformed Gaussian file to a service or application using Open Babel (such as the 'obabel' CLI tool). This can lead to memory corruption and arbitrary code execution. The vulnerability is addressed in version 3.2.0.
Affected products
- Open Babel Open Babel 3.1.1, master commit 530dbfa3, and all versions prior to 3.2.0
Timeline
- 2023-07-21: disclosed: Initial advisory publication
- 2023-07-21: advisory: Talos vulnerability report TALOS-2022-1672 published
- 2026-07-01: other: Advisory withdrawn as a duplicate of GHSA-vr3p-gg26-45v9