Multiple heap-based buffer overflows in WordPerfect Document importer/exporter (libwpd) before 0.8.9 allow user-assisted remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted WordPerfect file in which values to loop counters are not properly handled in the (1) WP3TablesGroup::_readContents and (2) WP5DefinitionGroup_DefineTablesSubGroup::WP5DefinitionGroup_DefineTablesSubGroup functions. NOTE: the integer overflow has been split into CVE-2007-1466.

StarSuite 8 (Solaris_x86): Update 18.
Date this patch was last updated by Sun : Mar/15/11

StarOffice 8 (Solaris_x86): Update 18.
Date this patch was last updated by Sun : Mar/15/11

StarSuite 8 (Solaris): Update 18.
Date this patch was last updated by Sun : Mar/15/11

StarOffice 8 (Solaris): Update 18.
Date this patch was last updated by Sun : Mar/15/11

Following security problems were fixed in OpenOffice_org :

This update also brings OpenOffice_org to version 2.0.4.17, same as SUSE Linux Enterprise Desktop 10 and contains lots of bugfixes.

It also contains support for the Office XML converter hooks.

  - Various problems were fixed in the Wordperfect converter     library libwpd in OpenOffice_org which could be used by     remote attackers to potentially execute code or crash     OpenOffice_org. (CVE-2007-0002)

  - A stack overflow in the StarCalc parser could be used by     remote attackers to potentially execute code by     supplying a crafted document. (CVE-2007-0238)

  - A shell quoting problem when opening URLs was fixed     which could be used by remote attackers to execute code     by supplying a crafted document and making the user     click on an embedded link. (CVE-2007-0239)

Sean Larsson of iDefense Labs discovered that libwpd was vulnerable to integer overflows. If a user were tricked into opening a specially crafted WordPerfect document with an application that used libwpd, an attacker could execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2007-0002: Various problems were fixed in the Wordperfect converter library libwpd in OpenOffice_org which could be used by remote attackers to potentially execute code or crash OpenOffice_org.

Following security problems were fixed in OpenOffice_org :

This update also brings OpenOffice_org to version 2.0.4.17, same as SUSE Linux Enterprise Desktop 10 and contains lots of bugfixes.

CVE-2007-0002: Various problems were fixed in the Wordperfect converter library libwpd in OpenOffice_org which could be used by remote attackers to potentially execute code or crash OpenOffice_org.

CVE-2007-0238: A stack overflow in the StarCalc parser could be used by remote attackers to potentially execute code by supplying a crafted document.

CVE-2007-0239: A shell quoting problem when opening URLs was fixed which could be used by remote attackers to execute code by supplying a crafted document and making the user click on an embedded link.

Also support for the upcoming ODF - OfficeXML converter was added.

Following security problems were fixed in OpenOffice_org :

CVE-2007-0002: Various problems were fixed in the Wordperfect converter library libwpd in OpenOffice_org which could be used by remote attackers to potentially execute code or crash OpenOffice_org.

CVE-2007-0238: A stack overflow in the StarCalc parser could be used by remote attackers to potentially execute code by supplying a crafted document.

CVE-2007-0239: A shell quoting problem when opening URLs was fixed which could be used by remote attackers to execute code by supplying a crafted document and making the user click on an embedded link.

Also support for the upcoming ODF - OfficeXML converter was added.

Updated libwpd packages to correct a security issue are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

libwpd is a library for reading and converting Word Perfect documents.

iDefense reported several overflow bugs in libwpd. An attacker could create a carefully crafted Word Perfect file that could cause an application linked with libwpd, such as OpenOffice, to crash or possibly execute arbitrary code if the file was opened by a victim.
(CVE-2007-0002)

All users are advised to upgrade to these updated packages, which contain a backported fix for this issue.

Red Hat would like to thank Fridrich Strba for alerting us to these issues and providing a patch.

The remote host is affected by the vulnerability described in GLSA-200704-12 (OpenOffice.org: Multiple vulnerabilities)

    John Heasman of NGSSoftware has discovered a stack-based buffer     overflow in the StarCalc parser and an input validation error when     processing metacharacters in a link. Also OpenOffice.Org includes code     from libwpd making it vulnerable to heap-based overflows when     converting WordPerfect document tables (GLSA 200704-07).
  Impact :

    A remote attacker could entice a user to open a specially crafted     document, possibly leading to execution of arbitrary code with the     rights of the user running OpenOffice.org.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-200704-07 (libwpd: Multiple vulnerabilities)

    libwpd contains heap-based overflows in two functions that convert     WordPerfect document tables. In addition, it contains an integer     overflow in a text-conversion function.
  Impact :

    An attacker could entice a user to convert a specially crafted     WordPerfect file, resulting in a crash or possibly the execution of     arbitrary code with the rights of the user running libwpd.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of Sun Microsystems OpenOffice.org that is prior to version 2.2. It is, therefore, affected by a stack-based buffer overflow vulnerability in its handling of StarCalc documents. If a remote attacker can trick a user into opening a specially crafted StarCalc document, the attacker can execute arbitrary code on the remote host subject to the user's privileges.

In addition, versions 2.0 - 2.1 reportedly have a heap-based buffer overflow vulnerability that can be triggered when importing a specially crafted WordPerfect document, resulting in arbitrary code execution.

New libwpd packages are available for Slackware 10.2, 11.0, and
-current to fix security issues.

CVE-2007-0002 buffer overflows in wordperfect document parsing

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several security related problems have been discovered in OpenOffice.org, the free office suite. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-0002     iDefense reported several integer overflow bugs in     libwpd, a library for handling WordPerfect documents     that is included in OpenOffice.org. Attackers are able     to exploit these with carefully crafted WordPerfect     files that could cause an application linked with libwpd     to crash or possibly execute arbitrary code.

  - CVE-2007-0238     Next Generation Security discovered that the StarCalc     parser in OpenOffice.org contains an easily exploitable     stack overflow that could be used by a specially crafted     document to execute arbitrary code.

  - CVE-2007-0239     It has been reported that OpenOffice.org does not escape     shell meta characters and is hence vulnerable to execute     arbitrary shell commands via a specially crafted     document after the user clicked to a prepared link.

This updated advisory only provides packages for the upcoming etch release alias Debian GNU/Linux 4.0.

iDefense reported several overflow bugs in libwpd. An attacker could create a carefully crafted Word Perfect file that could cause an application linked with libwpd, such as OpenOffice, to crash or possibly execute arbitrary code if the file was opened by a victim.

OpenOffice.org-2.X contains an embedded copy of libpwd, and as such is susceptible to the same issues.

Updated packages have been rebuilt using the system libwpd to address this issue.

iDefense reported several overflow bugs in libwpd. An attacker could create a carefully crafted Word Perfect file that could cause an application linked with libwpd, such as OpenOffice, to crash or possibly execute arbitrary code if the file was opened by a victim.

Updated packages have been patched to address this issue.

iDefense reported several integer overflow bugs in libwpd, a library for handling WordPerfect documents. Attackers were able to exploit these with carefully crafted Word Perfect files that could cause an application linked with libwpd to crash or possibly execute arbitrary code.

ID	Name	Product	Family	Severity
107858	Solaris 10 (x86) : 120190-23	Nessus	Solaris Local Security Checks	high
107857	Solaris 10 (x86) : 120186-23	Nessus	Solaris Local Security Checks	high
107356	Solaris 10 (sparc) : 120189-23	Nessus	Solaris Local Security Checks	high
107355	Solaris 10 (sparc) : 120185-23	Nessus	Solaris Local Security Checks	high
29365	SuSE 10 Security Update : OpenOffice_org (ZYPP Patch Number 2651)	Nessus	SuSE Local Security Checks	high
28033	Ubuntu 5.10 / 6.06 LTS / 6.10 : libwpd vulnerability (USN-437-1)	Nessus	Ubuntu Local Security Checks	high
27338	openSUSE 10 Security Update : libwpd (libwpd-3038)	Nessus	SuSE Local Security Checks	high
27337	openSUSE 10 Security Update : libwpd (libwpd-2642)	Nessus	SuSE Local Security Checks	high
27137	openSUSE 10 Security Update : OpenOffice_org (OpenOffice_org-2682)	Nessus	SuSE Local Security Checks	high
27136	openSUSE 10 Security Update : OpenOffice_org (OpenOffice_org-2652)	Nessus	SuSE Local Security Checks	high
25312	RHEL 5 : libwpd (RHSA-2007:0055)	Nessus	Red Hat Local Security Checks	high
25057	GLSA-200704-12 : OpenOffice.org: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
25020	GLSA-200704-07 : libwpd: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
25004	Sun OpenOffice.org < 2.2 Multiple Vulnerabilities	Nessus	Windows	high
24915	Slackware 10.2 / 11.0 / current : libwpd (SSA:2007-085-02)	Nessus	Slackware Local Security Checks	high
24884	Fedora Core 5 : libwpd-0.8.9-1.fc5 (2007-350)	Nessus	Fedora Local Security Checks	high
24879	Debian DSA-1270-2 : openoffice.org - several vulnerabilities	Nessus	Debian Local Security Checks	high
24843	Mandrake Linux Security Advisory : openoffice.org (MDKSA-2007:064)	Nessus	Mandriva Local Security Checks	high
24842	Mandrake Linux Security Advisory : libwpd (MDKSA-2007:063)	Nessus	Mandriva Local Security Checks	high
24835	Debian DSA-1268-1 : libwpd - integer overflow	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2007-0002

critical

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high