HSQLDB before 1.8.0.9, as used in OpenOffice.org (OOo) 2 before 2.3.1, allows user-assisted remote attackers to execute arbitrary Java code via crafted database documents, related to "exposing static java methods."

StarSuite 8 (Solaris_x86): Update 18.
Date this patch was last updated by Sun : Mar/15/11

StarOffice 8 (Solaris_x86): Update 18.
Date this patch was last updated by Sun : Mar/15/11

StarSuite 8 (Solaris): Update 18.
Date this patch was last updated by Sun : Mar/15/11

StarOffice 8 (Solaris): Update 18.
Date this patch was last updated by Sun : Mar/15/11

New JBoss Enterprise Application Platform (JBEAP) packages, comprising the 4.2.0.CP02 release, are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

JBEAP is a middleware platform for Java 2 Platform, Enterprise Edition (J2EE) applications.

This release of JBEAP for Red Hat Enterprise Linux 5 contains the JBoss Application Server and JBoss Seam and serves as a replacement for JBEAP 4.2.0.GA_CP01. As well as fixing numerous bugs and adding enhancements, these updated packages addresses several security issues.

The JFreeChart component was vulnerable to multiple cross-site scripting (XSS) vulnerabilities. An attacker could misuse the image map feature to inject arbitrary web script or HTML via several attributes of the chart area. (CVE-2007-6306)

A vulnerability caused by exposing static java methods was located within the HSQLDB component. This could be utilized by an attacker to execute arbitrary static java methods. (CVE-2007-4575)

The setOrder method in the org.jboss.seam.framework.Query class did not properly validate user-supplied parameters. This vulnerability allowed remote attackers to inject and execute arbitrary EJBQL commands via the order parameter. (CVE-2007-6433)

For details regarding the bug fixes and enhancements included with this update, please see the JBoss Enterprise Application Platform 4.2.0.CP02 Release Notes, linked to in the References section below.

All Red Hat Enterprise Linux 5 users wanting to use the JBoss Enterprise Application Platform are advised to install these new packages.

Updated JBoss Enterprise Application Platform (JBEAP) packages that fix several security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

JBoss Enterprise Application Platform (JBEAP) is a middleware platform for Java 2 Platform, Enterprise Edition (J2EE) applications.

This release of JBEAP for Red Hat Enterprise Linux 4 contains the JBoss Application Server and JBoss Seam. This release serves as a replacement to JBEAP 4.2.0.GA. It fixes several security issues :

The JFreeChart component was vulnerable to multiple cross-site scripting (XSS) vulnerabilities. An attacker could misuse the image map feature to inject arbitrary web script, or HTML, via several attributes of the chart area. (CVE-2007-6306)

A vulnerability caused by exposing static Java methods was located within the HSQLDB component. This could be utilized by an attacker to execute arbitrary static Java methods. (CVE-2007-4575)

The setOrder method in the org.jboss.seam.framework.Query class did not correctly validate user-supplied parameters. This vulnerability allowed remote attackers to inject, and execute, arbitrary Enterprise JavaBeans Query Language (EJB QL) commands via the order parameter.
(CVE-2007-6433)

These updated packages include bug fixes and enhancements which are not listed here. For a full list, please refer to the JBEAP 4.2.0CP02 release notes:
http://redhat.com/docs/manuals/jboss/jboss-eap-4.2.0.cp02/readme.html

Warning: before applying this update, please backup the JBEAP 'server/[configuration]/deploy/' directory, and any other customized configuration files.

All users of JBEAP on Red Hat Enterprise Linux 4 are advised to upgrade to these updated packages, which resolve these issues.

Updated openoffice.org and hsqldb packages that fix security flaws are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

OpenOffice.org is an office productivity suite. HSQLDB is a Java relational database engine used by OpenOffice.org Base.

It was discovered that HSQLDB could allow the execution of arbitrary public static Java methods. A carefully crafted odb file opened in OpenOffice.org Base could execute arbitrary commands with the permissions of the user running OpenOffice.org. (CVE-2007-4575)

It was discovered that HSQLDB did not have a password set on the 'sa' user. If HSQLDB has been configured as a service, a remote attacker who could connect to the HSQLDB port (tcp 9001) could execute arbitrary SQL commands. (CVE-2003-0845)

Note that in Red Hat Enterprise Linux 5, HSQLDB is not enabled as a service by default, and needs manual configuration in order to work as a service.

Users of OpenOffice.org or HSQLDB should update to these errata packages which contain backported patches to correct these issues.

It was discovered that HSQLDB could allow the execution of arbitrary public static Java methods. A carefully crafted odb file opened in OpenOffice.org Base could execute arbitrary commands with the permissions of the user running OpenOffice.org. (CVE-2007-4575)

It was discovered that HSQLDB did not have a password set on the 'sa' user. If HSQLDB has been configured as a service, a remote attacker who could connect to the HSQLDB port (tcp 9001) could execute arbitrary SQL commands. (CVE-2003-0845)

Note that in Scientific Linux 5, HSQLDB is not enabled as a service by default, and needs manual configuration in order to work as a service.

It was discovered that HSQLDB could allow the execution of arbitrary public static Java methods. A carefully crafted odb file opened in OpenOffice.org Base could execute arbitrary commands with the permissions of the user running OpenOffice.org. (CVE-2007-4575)

A vulnerability in HSQLDB before 1.8.0.9 in OpenOffice.org could allow user-assisted remote attackers to execute arbitrary Java code via crafted database documents (CVE-2007-4575).

A heap overflow was discovered in OpenOffice.org's EMF parser. An attacker could create a carefully crafted EMF file that could cause OpenOffice.org to crash or potentially execute arbitrary code if the malicious EMF image was added to a document or if a document containing such an EMF file was opened (CVE-2007-5746).

Multiple heap overflows and an integer underflow were discovered in the Quattro Pro(R) import filter. An attacker could create a carefully crafted Quattro Pro file that could cause OpenOffice.org ro crash or potentially execute arbitrary code (CVE-2007-5745, CVE-2007-5747).

A heap overflow was discovered in the OLE Structured Storage file parser, a format used by Microsoft Office documents. An attacker could create a carefully crafted OLE file that could cause OpenOffice.org to crash or potentially execute arbitrary code (CVE-2008-0320).

The updated packages have been patched to correct these issues.

It was discovered that arbitrary Java methods were not filtered out when opening databases in OpenOffice.org. If a user were tricked into running a specially crafted query, a remote attacker could execute arbitrary Java with user privileges. (CVE-2007-4575)

Multiple memory overflow flaws were discovered in OpenOffice.org's handling of Quattro Pro, EMF, and OLE files. If a user were tricked into opening a specially crafted document, a remote attacker might be able to execute arbitrary code with user privileges. (CVE-2007-5745, CVE-2007-5746, CVE-2007-5747, CVE-2008-0320).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Backporting a fix for CVE-2007-4576.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575)

The remote host is affected by the vulnerability described in GLSA-200712-25 (OpenOffice.org: User-assisted arbitrary code execution)

    The HSQLDB engine, as used in Openoffice.org, does not properly enforce     restrictions to SQL statements.
  Impact :

    A remote attacker could entice a user to open a specially crafted     document, possibly resulting in the remote execution of arbitrary Java     code with the privileges of the user running OpenOffice.org.
  Workaround :

    There is no known workaround at this time.

CVE-2007-4575 restrict java instantiation features of hsqldb

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated openoffice.org2 packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

OpenOffice.org is an office productivity suite. HSQLDB is the default database engine shipped with OpenOffice.org 2.

It was discovered that HSQLDB could allow the execution of arbitrary public static Java methods. A carefully crafted odb file opened in OpenOffice.org Base could execute arbitrary commands with the permissions of the user running OpenOffice.org. (CVE-2007-4575)

All users of OpenOffice.org are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue.

A vulnerability has been discovered in HSQLDB, the default database engine shipped with OpenOffice.org. This could result in the execution of arbitrary Java code embedded in a OpenOffice.org database document with the user's privilege. This update requires an update of both openoffice.org and hsqldb.

The remote host is running a version of OpenOffice.org that is affected by a remote code execution flaw.  The root of the flaw appears to be the HSQLDB database engine.  An attacker exploiting this flaw would need to be able to convince a user to open a file that was handled by the OpenOffice HSQLDB database engine.  Successful exploitation would result in the attacker executing arbitrary Java code on the remote system.

The remote host is running a version of Sun Microsystems OpenOffice.org that contains an arbitrary code execution vulnerability in its HSQLDB database engine. If a remote attacker can trick a user into opening a specially crafted database, this issue can be leveraged to execute arbitrary static Java code on the remote host subject to the user's privileges.

ID	Name	Product	Family	Severity
107858	Solaris 10 (x86) : 120190-23	Nessus	Solaris Local Security Checks	high
107857	Solaris 10 (x86) : 120186-23	Nessus	Solaris Local Security Checks	high
107356	Solaris 10 (sparc) : 120189-23	Nessus	Solaris Local Security Checks	high
107355	Solaris 10 (sparc) : 120185-23	Nessus	Solaris Local Security Checks	high
63851	RHEL 5 : JBoss EAP (RHSA-2008:0213)	Nessus	Red Hat Local Security Checks	high
63848	RHEL 4 : JBoss EAP (RHSA-2008:0151)	Nessus	Red Hat Local Security Checks	high
63845	RHEL 5 : openoffice.org, hsqldb (RHSA-2007:1048)	Nessus	Red Hat Local Security Checks	high
60324	Scientific Linux Security Update : openoffice.org, hsqldb on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60323	Scientific Linux Security Update : openoffice.org2 on SL4.5 i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
43661	CentOS 5 : openoffice.org / hsqldb (CESA-2007:1048)	Nessus	CentOS Local Security Checks	high
37969	Mandriva Linux Security Advisory : openoffice.org (MDVSA-2008:095)	Nessus	Mandriva Local Security Checks	high
32189	Ubuntu 6.06 LTS / 7.04 / 7.10 : hsqldb, openoffice.org/-amd64 vulnerabilities (USN-609-1)	Nessus	Ubuntu Local Security Checks	high
30069	Fedora 8 : hsqldb-1.8.0.8-1jpp.5.fc8 (2007-4171)	Nessus	Fedora Local Security Checks	high
30068	Fedora 7 : hsqldb-1.8.0.8-1jpp.5.fc7 (2007-4119)	Nessus	Fedora Local Security Checks	high
29877	openSUSE 10 Security Update : OpenOffice_org (OpenOffice_org-4802)	Nessus	SuSE Local Security Checks	high
29822	GLSA-200712-25 : OpenOffice.org: User-assisted arbitrary code execution	Nessus	Gentoo Local Security Checks	high
29368	SuSE 10 Security Update : OpenOffice_org (ZYPP Patch Number 4770)	Nessus	SuSE Local Security Checks	high
29286	Fedora Core 6 : openoffice.org-2.0.4-5.5.25 (2007-762)	Nessus	Fedora Local Security Checks	high
29274	Fedora 8 : openoffice.org-2.3.0-6.7.fc8 (2007-4172)	Nessus	Fedora Local Security Checks	high
29268	Fedora 7 : openoffice.org-2.3.0-6.5.fc7 (2007-4120)	Nessus	Fedora Local Security Checks	high
29240	openSUSE 10 Security Update : OpenOffice_org (OpenOffice_org-4769)	Nessus	SuSE Local Security Checks	high
29235	RHEL 4 : openoffice.org2 (RHSA-2007:1090)	Nessus	Red Hat Local Security Checks	high
29226	Debian DSA-1419-1 : openoffice.org - programming error	Nessus	Debian Local Security Checks	high
4308	OpenOffice HSQLDB Document Handling Java Code Injection	Nessus Network Monitor	Generic	medium
29218	Sun OpenOffice.org < 2.3.1 Database HSQLDB Database Document Handling Arbitrary Java Code Execution	Nessus	Windows	high

Detections

Analytics

CVE-2007-4575

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

medium

high