Integer overflow in OpenOffice.org before 2.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an EMF file with a crafted EMR_STRETCHBLT record, which triggers a heap-based buffer overflow.

From Red Hat Security Advisory 2008:0176 :

Updated openoffice.org 1.x packages to correct multiple security issues are now available for Red Hat Enterprise Linux 3 and Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

OpenOffice.org is an office productivity suite that includes desktop applications such as a word processor, spreadsheet, presentation manager, formula editor, and drawing program.

A heap overflow flaw was found in the EMF parser. An attacker could create a carefully crafted EMF file that could cause OpenOffice.org to crash or possibly execute arbitrary code if the malicious EMF image was added to a document or if a document containing the malicious EMF file was opened by a victim. (CVE-2007-5746)

A heap overflow flaw was found in the OLE Structured Storage file parser. (OLE Structured Storage is a format used by Microsoft Office documents.) An attacker could create a carefully crafted OLE file that could cause OpenOffice.org to crash or possibly execute arbitrary code if the file was opened by a victim. (CVE-2008-0320)

All users of OpenOffice.org are advised to upgrade to these updated packages, which contain backported fixes to correct these issues.

Multiple heap overflows and an integer underflow were found in the Quattro Pro(R) import filter. An attacker could create a carefully crafted Quattro Pro file that could cause OpenOffice.org to crash or possibly execute arbitrary code if the file was opened by a victim.
(CVE-2007-5745, CVE-2007-5747)

A heap overflow flaw was found in the EMF parser. An attacker could create a carefully crafted EMF file that could cause OpenOffice.org to crash or possibly execute arbitrary code if the malicious EMF image was added to a document or if a document containing the malicious EMF file was opened by a victim. (CVE-2007-5746)

A heap overflow flaw was found in the OLE Structured Storage file parser. (OLE Structured Storage is a format used by Microsoft Office documents.) An attacker could create a carefully crafted OLE file that could cause OpenOffice.org to crash or possibly execute arbitrary code if the file was opened by a victim. (CVE-2008-0320)

A heap overflow flaw was found in the EMF parser. An attacker could create a carefully crafted EMF file that could cause OpenOffice.org to crash or possibly execute arbitrary code if the malicious EMF image was added to a document or if a document containing the malicious EMF file was opened by a victim. (CVE-2007-5746)

A heap overflow flaw was found in the OLE Structured Storage file parser. (OLE Structured Storage is a format used by Microsoft Office documents.) An attacker could create a carefully crafted OLE file that could cause OpenOffice.org to crash or possibly execute arbitrary code if the file was opened by a victim. (CVE-2008-0320)

A vulnerability in HSQLDB before 1.8.0.9 in OpenOffice.org could allow user-assisted remote attackers to execute arbitrary Java code via crafted database documents (CVE-2007-4575).

A heap overflow was discovered in OpenOffice.org's EMF parser. An attacker could create a carefully crafted EMF file that could cause OpenOffice.org to crash or potentially execute arbitrary code if the malicious EMF image was added to a document or if a document containing such an EMF file was opened (CVE-2007-5746).

Multiple heap overflows and an integer underflow were discovered in the Quattro Pro(R) import filter. An attacker could create a carefully crafted Quattro Pro file that could cause OpenOffice.org ro crash or potentially execute arbitrary code (CVE-2007-5745, CVE-2007-5747).

A heap overflow was discovered in the OLE Structured Storage file parser, a format used by Microsoft Office documents. An attacker could create a carefully crafted OLE file that could cause OpenOffice.org to crash or potentially execute arbitrary code (CVE-2008-0320).

The updated packages have been patched to correct these issues.

Following security issues were addressed in this update: # CVE-2007-5745/5747: Manipulated Quattro Pro files can lead to heap overflows and arbitrary code execution # CVE-2007-5746: Manipulated EMF files can lead to heap overflows and arbitrary code execution # CVE-2008-0320: Manipulated OLE files can lead to heap overflows and arbitrary code execution

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200805-16 (OpenOffice.org: Multiple vulnerabilities)

    iDefense Labs reported multiple vulnerabilities in OpenOffice.org:
    multiple heap-based buffer overflows when parsing the 'Attribute' and     'Font' Description records of Quattro Pro (QPRO) files     (CVE-2007-5745),     an integer overflow when parsing the EMR_STRETCHBLT record of an EMF     file, resulting in a heap-based buffer overflow (CVE-2007-5746),     an integer underflow when parsing Quattro Pro (QPRO) files, resulting     in an excessive loop and a stack-based buffer overflow     (CVE-2007-5747),     and a heap-based buffer overflow when parsing the     'DocumentSummaryInformation' stream in an OLE file (CVE-2008-0320).
    Furthermore, Will Drewry (Google Security) reported vulnerabilities in     the memory management of the International Components for Unicode     (CVE-2007-4770, CVE-2007-4771), which was resolved with GLSA 200803-20.
    However, the binary version of OpenOffice.org uses an internal copy of     said library.
  Impact :

    A remote attacker could entice a user to open a specially crafted     document, possibly resulting in the remote execution of arbitrary code     with the privileges of the user running OpenOffice.org.
  Workaround :

    There is no known workaround at this time.

It was discovered that arbitrary Java methods were not filtered out when opening databases in OpenOffice.org. If a user were tricked into running a specially crafted query, a remote attacker could execute arbitrary Java with user privileges. (CVE-2007-4575)

Multiple memory overflow flaws were discovered in OpenOffice.org's handling of Quattro Pro, EMF, and OLE files. If a user were tricked into opening a specially crafted document, a remote attacker might be able to execute arbitrary code with user privileges. (CVE-2007-5745, CVE-2007-5746, CVE-2007-5747, CVE-2008-0320).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated openoffice.org 1.x packages to correct multiple security issues are now available for Red Hat Enterprise Linux 3 and Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

OpenOffice.org is an office productivity suite that includes desktop applications such as a word processor, spreadsheet, presentation manager, formula editor, and drawing program.

A heap overflow flaw was found in the EMF parser. An attacker could create a carefully crafted EMF file that could cause OpenOffice.org to crash or possibly execute arbitrary code if the malicious EMF image was added to a document or if a document containing the malicious EMF file was opened by a victim. (CVE-2007-5746)

A heap overflow flaw was found in the OLE Structured Storage file parser. (OLE Structured Storage is a format used by Microsoft Office documents.) An attacker could create a carefully crafted OLE file that could cause OpenOffice.org to crash or possibly execute arbitrary code if the file was opened by a victim. (CVE-2008-0320)

All users of OpenOffice.org are advised to upgrade to these updated packages, which contain backported fixes to correct these issues.

Updated openoffice.org 2.x packages to correct multiple security issues are now available for Red Hat Enterprise Linux 4 and Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

OpenOffice.org is an office productivity suite that includes desktop applications such as a word processor, spreadsheet, presentation manager, formula editor, and drawing program.

Multiple heap overflows and an integer underflow were found in the Quattro Pro(R) import filter. An attacker could create a carefully crafted Quattro Pro file that could cause OpenOffice.org to crash or possibly execute arbitrary code if the file was opened by a victim.
(CVE-2007-5745, CVE-2007-5747)

A heap overflow flaw was found in the EMF parser. An attacker could create a carefully crafted EMF file that could cause OpenOffice.org to crash or possibly execute arbitrary code if the malicious EMF image was added to a document or if a document containing the malicious EMF file was opened by a victim. (CVE-2007-5746)

A heap overflow flaw was found in the OLE Structured Storage file parser. (OLE Structured Storage is a format used by Microsoft Office documents.) An attacker could create a carefully crafted OLE file that could cause OpenOffice.org to crash or possibly execute arbitrary code if the file was opened by a victim. (CVE-2008-0320)

All users of OpenOffice.org are advised to upgrade to these updated packages, which contain backported fixes to correct these issues.

Several security related problems have been discovered in OpenOffice.org, the free office suite. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-5745, CVE-2007-5747     Several bugs have been discovered in the way     OpenOffice.org parses Quattro Pro files that may lead to     a overflow in the heap potentially leading to the     execution of arbitrary code.

  - CVE-2007-5746     Specially crafted EMF files can trigger a buffer     overflow in the heap that may lead to the execution of     arbitrary code.

  - CVE-2008-0320     A bug has been discovered in the processing of OLE files     that can cause a buffer overflow in the heap potentially     leading to the execution of arbitrary code.

Recently reported problems in the ICU library are fixed in separate libicu packages with DSA 1511 against which OpenOffice.org is linked.

The version of OpenOffice installed on the remote host is reportedly affected by several issues :

  - Heap overflow and arbitrary code execution vulnerabilities involving ODF text documents with XForms (CVE-2007-4770/4771).
  - Heap overflow and arbitrary code execution vulnerabilities involving Quattro Pro files (CVE-2007-5745/5747).
  - Heap overflow and arbitrary code execution vulnerabilities involving EMF files (CVE-2007-5746).
  - Heap overflow and arbitrary code execution vulnerabilities involving OLE files (CVE-2008-0320).

The version of Sun Microsystems OpenOffice.org installed on the remote host is affected by several issues :

  - Heap overflow and arbitrary code execution     vulnerabilities involving ODF text documents with     XForms (CVE-2007-4770/4771).

  - Heap overflow and arbitrary code execution     vulnerabilities involving Quattro Pro files     (CVE-2007-5745/5747).

  - Heap overflow and arbitrary code execution     vulnerabilities involving EMF files (CVE-2007-5746).

  - Heap overflow and arbitrary code execution     vulnerabilities involving OLE files (CVE-2008-0320).

ID	Name	Product	Family	Severity
67666	Oracle Linux 3 / 4 : openoffice.org (ELSA-2008-0176)	Nessus	Oracle Linux Local Security Checks	high
60390	Scientific Linux Security Update : openoffice.org on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60389	Scientific Linux Security Update : openoffice.org on SL3.x, SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60388	Scientific Linux Security Update : openoffice.org2 on SL4.5 and 4.6 i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
37969	Mandriva Linux Security Advisory : openoffice.org (MDVSA-2008:095)	Nessus	Mandriva Local Security Checks	high
32385	Fedora 7 : openoffice.org-2.3.0-6.8.fc7 (2008-4104)	Nessus	Fedora Local Security Checks	high
32353	GLSA-200805-16 : OpenOffice.org: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
32189	Ubuntu 6.06 LTS / 7.04 / 7.10 : hsqldb, openoffice.org/-amd64 vulnerabilities (USN-609-1)	Nessus	Ubuntu Local Security Checks	high
32042	Fedora 8 : openoffice.org-2.3.0-6.14.fc8 (2008-3251)	Nessus	Fedora Local Security Checks	high
32019	RHEL 3 / 4 : openoffice.org (RHSA-2008:0176)	Nessus	Red Hat Local Security Checks	high
32018	RHEL 4 / 5 : openoffice.org (RHSA-2008:0175)	Nessus	Red Hat Local Security Checks	high
31997	CentOS 3 / 4 : openoffice.org (CESA-2008:0176)	Nessus	CentOS Local Security Checks	high
31996	CentOS 4 / 5 : openoffice.org / openoffice.org2 (CESA-2008:0175)	Nessus	CentOS Local Security Checks	high
31969	Debian DSA-1547-1 : openoffice.org - several vulnerabilities	Nessus	Debian Local Security Checks	high
4474	OpenOffice < 2.4 Multiple Vulnerabilities	Nessus Network Monitor	Generic	medium
31968	Sun OpenOffice.org < 2.4 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2007-5746

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

medium

high