Stack-based buffer overflow in filter\starcalc\scflt.cxx in the StarCalc parser in OpenOffice.org (OOo) Office Suite before 2.2, and 1.x before 1.1.5 Patch, allows user-assisted remote attackers to execute arbitrary code via a document with a long Note.

StarSuite 8 (Solaris_x86): Update 18.
Date this patch was last updated by Sun : Mar/15/11

StarOffice 8 (Solaris_x86): Update 18.
Date this patch was last updated by Sun : Mar/15/11

StarSuite 8 (Solaris): Update 18.
Date this patch was last updated by Sun : Mar/15/11

StarOffice 8 (Solaris): Update 18.
Date this patch was last updated by Sun : Mar/15/11

From Red Hat Security Advisory 2007:0033 :

Updated openoffice.org packages to correct security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

OpenOffice.org is an office productivity suite that includes desktop applications such as a word processor, spreadsheet, presentation manager, formula editor, and drawing program.

iDefense reported an integer overflow flaw in libwpd, a library used internally to OpenOffice.org for handling Word Perfect documents. An attacker could create a carefully crafted Word Perfect file that could cause OpenOffice.org to crash or possibly execute arbitrary code if the file was opened by a victim. (CVE-2007-1466)

John Heasman discovered a stack overflow in the StarCalc parser in OpenOffice.org. An attacker could create a carefully crafted StarCalc file that could cause OpenOffice.org to crash or possibly execute arbitrary code if the file was opened by a victim. (CVE-2007-0238)

Flaws were discovered in the way OpenOffice.org handled hyperlinks. An attacker could create an OpenOffice.org document which could run commands if a victim opened the file and clicked on a malicious hyperlink. (CVE-2007-0239)

All users of OpenOffice.org are advised to upgrade to these updated packages, which contain backported fixes for these issues.

Red Hat would like to thank Fridrich Strba for alerting us to the issue CVE-2007-1466 and providing a patch, and John Heasman for CVE-2007-0238.

Updated openoffice.org packages to correct security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

OpenOffice.org is an office productivity suite that includes desktop applications such as a word processor, spreadsheet, presentation manager, formula editor, and drawing program.

John Heasman discovered a stack overflow in the StarCalc parser in OpenOffice. An attacker could create a carefully crafted StarCalc file that could cause OpenOffice.org to crash or possibly execute arbitrary code if the file was opened by a victim. (CVE-2007-0238)

Flaws were discovered in the way OpenOffice.org handled hyperlinks. An attacker could create an OpenOffice.org document which could run commands if a victim opened the file and clicked on a malicious hyperlink. (CVE-2007-0239)

All users of OpenOffice.org are advised to upgrade to these updated packages, which contain a backported fix to correct this issue.

Following security problems were fixed in OpenOffice_org :

This update also brings OpenOffice_org to version 2.0.4.17, same as SUSE Linux Enterprise Desktop 10 and contains lots of bugfixes.

It also contains support for the Office XML converter hooks.

  - Various problems were fixed in the Wordperfect converter     library libwpd in OpenOffice_org which could be used by     remote attackers to potentially execute code or crash     OpenOffice_org. (CVE-2007-0002)

  - A stack overflow in the StarCalc parser could be used by     remote attackers to potentially execute code by     supplying a crafted document. (CVE-2007-0238)

  - A shell quoting problem when opening URLs was fixed     which could be used by remote attackers to execute code     by supplying a crafted document and making the user     click on an embedded link. (CVE-2007-0239)

A stack overflow was discovered in OpenOffice.org's StarCalc parser.
If a user were tricked into opening a specially crafted document, a remote attacker could execute arbitrary code with user privileges.
(CVE-2007-0238)

A flaw was discovered in OpenOffice.org's link handling code. If a user were tricked into clicking a link in a specially crafted document, a remote attacker could execute arbitrary shell commands with user privileges. (CVE-2007-0239).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Following security problems were fixed in OpenOffice_org :

This update also brings OpenOffice_org to version 2.0.4.17, same as SUSE Linux Enterprise Desktop 10 and contains lots of bugfixes.

CVE-2007-0002: Various problems were fixed in the Wordperfect converter library libwpd in OpenOffice_org which could be used by remote attackers to potentially execute code or crash OpenOffice_org.

CVE-2007-0238: A stack overflow in the StarCalc parser could be used by remote attackers to potentially execute code by supplying a crafted document.

CVE-2007-0239: A shell quoting problem when opening URLs was fixed which could be used by remote attackers to execute code by supplying a crafted document and making the user click on an embedded link.

Also support for the upcoming ODF - OfficeXML converter was added.

Following security problems were fixed in OpenOffice_org :

CVE-2007-0002: Various problems were fixed in the Wordperfect converter library libwpd in OpenOffice_org which could be used by remote attackers to potentially execute code or crash OpenOffice_org.

CVE-2007-0238: A stack overflow in the StarCalc parser could be used by remote attackers to potentially execute code by supplying a crafted document.

CVE-2007-0239: A shell quoting problem when opening URLs was fixed which could be used by remote attackers to execute code by supplying a crafted document and making the user click on an embedded link.

Also support for the upcoming ODF - OfficeXML converter was added.

The remote host is affected by the vulnerability described in GLSA-200704-12 (OpenOffice.org: Multiple vulnerabilities)

    John Heasman of NGSSoftware has discovered a stack-based buffer     overflow in the StarCalc parser and an input validation error when     processing metacharacters in a link. Also OpenOffice.Org includes code     from libwpd making it vulnerable to heap-based overflows when     converting WordPerfect document tables (GLSA 200704-07).
  Impact :

    A remote attacker could entice a user to open a specially crafted     document, possibly leading to execution of arbitrary code with the     rights of the user running OpenOffice.org.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of Sun Microsystems OpenOffice.org that is prior to version 2.2. It is, therefore, affected by a stack-based buffer overflow vulnerability in its handling of StarCalc documents. If a remote attacker can trick a user into opening a specially crafted StarCalc document, the attacker can execute arbitrary code on the remote host subject to the user's privileges.

In addition, versions 2.0 - 2.1 reportedly have a heap-based buffer overflow vulnerability that can be triggered when importing a specially crafted WordPerfect document, resulting in arbitrary code execution.

Stack-based buffer overflow in the StarCalc parser in OpenOffice.org (OOo) Office Suite allows user-assisted remote attackers to execute arbitrary code via a crafted document. (CVE-2007-0238)

OpenOffice.org (OOo) Office Suite allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a prepared link in a crafted document. (CVE-2007-0239)

Updated packages have been patched to correct these issues.

Updated openoffice.org packages to correct security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

OpenOffice.org is an office productivity suite that includes desktop applications such as a word processor, spreadsheet, presentation manager, formula editor, and drawing program.

iDefense reported an integer overflow flaw in libwpd, a library used internally to OpenOffice.org for handling Word Perfect documents. An attacker could create a carefully crafted Word Perfect file that could cause OpenOffice.org to crash or possibly execute arbitrary code if the file was opened by a victim. (CVE-2007-1466)

John Heasman discovered a stack overflow in the StarCalc parser in OpenOffice.org. An attacker could create a carefully crafted StarCalc file that could cause OpenOffice.org to crash or possibly execute arbitrary code if the file was opened by a victim. (CVE-2007-0238)

Flaws were discovered in the way OpenOffice.org handled hyperlinks. An attacker could create an OpenOffice.org document which could run commands if a victim opened the file and clicked on a malicious hyperlink. (CVE-2007-0239)

All users of OpenOffice.org are advised to upgrade to these updated packages, which contain backported fixes for these issues.

Red Hat would like to thank Fridrich Strba for alerting us to the issue CVE-2007-1466 and providing a patch, and John Heasman for CVE-2007-0238.

Several security related problems have been discovered in OpenOffice.org, the free office suite. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-0002     iDefense reported several integer overflow bugs in     libwpd, a library for handling WordPerfect documents     that is included in OpenOffice.org. Attackers are able     to exploit these with carefully crafted WordPerfect     files that could cause an application linked with libwpd     to crash or possibly execute arbitrary code.

  - CVE-2007-0238     Next Generation Security discovered that the StarCalc     parser in OpenOffice.org contains an easily exploitable     stack overflow that could be used by a specially crafted     document to execute arbitrary code.

  - CVE-2007-0239     It has been reported that OpenOffice.org does not escape     shell meta characters and is hence vulnerable to execute     arbitrary shell commands via a specially crafted     document after the user clicked to a prepared link.

This updated advisory only provides packages for the upcoming etch release alias Debian GNU/Linux 4.0.

ID	Name	Product	Family	Severity
107858	Solaris 10 (x86) : 120190-23	Nessus	Solaris Local Security Checks	high
107857	Solaris 10 (x86) : 120186-23	Nessus	Solaris Local Security Checks	high
107356	Solaris 10 (sparc) : 120189-23	Nessus	Solaris Local Security Checks	high
107355	Solaris 10 (sparc) : 120185-23	Nessus	Solaris Local Security Checks	high
67443	Oracle Linux 3 / 4 : openoffice.org (ELSA-2007-0033)	Nessus	Oracle Linux Local Security Checks	high
63838	RHEL 5 : openoffice.org (RHSA-2007:0069)	Nessus	Red Hat Local Security Checks	high
29365	SuSE 10 Security Update : OpenOffice_org (ZYPP Patch Number 2651)	Nessus	SuSE Local Security Checks	high
28041	Ubuntu 5.10 / 6.06 LTS / 6.10 : openoffice.org(2)/-amd64, ia32-libs-openoffice.org vulnerabilities (USN-444-1)	Nessus	Ubuntu Local Security Checks	high
27137	openSUSE 10 Security Update : OpenOffice_org (OpenOffice_org-2682)	Nessus	SuSE Local Security Checks	high
27136	openSUSE 10 Security Update : OpenOffice_org (OpenOffice_org-2652)	Nessus	SuSE Local Security Checks	high
25057	GLSA-200704-12 : OpenOffice.org: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
25004	Sun OpenOffice.org < 2.2 Multiple Vulnerabilities	Nessus	Windows	high
24941	Mandrake Linux Security Advisory : openoffice.org (MDKSA-2007:073)	Nessus	Mandriva Local Security Checks	high
24896	RHEL 3 / 4 : openoffice.org (RHSA-2007:0033)	Nessus	Red Hat Local Security Checks	high
24879	Debian DSA-1270-2 : openoffice.org - several vulnerabilities	Nessus	Debian Local Security Checks	high
24877	CentOS 3 / 4 : openoffice.org (CESA-2007:0033)	Nessus	CentOS Local Security Checks	high

Detections

Analytics

CVE-2007-0238

critical

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high