The excel_read_HLINK function in plugins/excel/ms-excel-read.c in Gnome Office Gnumeric before 1.8.1 allows user-assisted remote attackers to execute arbitrary code via a crafted XLS file containing XLS HLINK opcodes, possibly because of an integer signedness error that leads to an integer overflow. NOTE: some of these details are obtained from third party information.

A vulnerability was found in the excel_read_HLINK function in the Microsoft Excel plugin in Gnumeric prior to version 1.8.1 that would allow for the execution of arbitrary code via a crafted XLS file containing XLS HLINK opcodes.

The updated packages have been patched to correct this issues.

Specially crafed xls files could trigger integer overflows in gnumeric that could potentially be exploited to execute arbitrary code (CVE-2008-0668).

Thilo Pfennig and Morten Welinder discovered that the XLS spreadsheet handling code in Gnumeric did not correctly calculate needed memory sizes. If a user or automated system were tricked into loading a specially crafted XLS document, a remote attacker could execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Thilo Pfennig and Morten Welinder discovered several integer overflow weaknesses in Gnumeric, a GNOME spreadsheet application. These vulnerabilities could result in the execution of arbitrary code through the opening of a maliciously crafted Excel spreadsheet.

The remote host is affected by the vulnerability described in GLSA-200802-05 (Gnumeric: User-assisted execution of arbitrary code)

    Multiple integer overflow and signedness errors have been reported in     the excel_read_HLINK() function in file plugins/excel/ms-excel-read.c     when processing XLS HLINK opcodes.
  Impact :

    A remote attacker could entice a user to open a specially crafted XLS     file, possibly resulting in the remote execution of arbitrary code with     the privileges of the user running the application.
  Workaround :

    There is no known workaround at this time.

Fix integer overflow and signedness errors in XLS processing

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
37027	Mandriva Linux Security Advisory : gnumeric (MDVSA-2008:056)	Nessus	Mandriva Local Security Checks	high
33559	openSUSE 10 Security Update : gnumeric (gnumeric-5393)	Nessus	SuSE Local Security Checks	high
32054	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : gnumeric vulnerability (USN-604-1)	Nessus	Ubuntu Local Security Checks	high
31952	Debian DSA-1546-1 : gnumeric - integer overflow	Nessus	Debian Local Security Checks	high
31083	GLSA-200802-05 : Gnumeric: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
30240	Fedora 8 : gnumeric-1.6.3-14.fc8 (2008-1403)	Nessus	Fedora Local Security Checks	high
30237	Fedora 7 : gnumeric-1.6.3-14.fc7 (2008-1313)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2008-0668

high

Tenable Plugins

high

high

high

high

high

high

high