Integer overflow in the rtl_allocateMemory function in sal/rtl/source/alloc_global.c in OpenOffice.org (OOo) 2.0 through 2.4 allows remote attackers to execute arbitrary code via a crafted file that triggers a heap-based buffer overflow.

From Red Hat Security Advisory 2008:0538 :

Updated openoffice.org packages to correct two security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

OpenOffice.org is an office productivity suite that includes desktop applications such as a word processor, spreadsheet, presentation manager, formula editor, and drawing program.

Sean Larsson found a heap overflow flaw in the OpenOffice memory allocator. If a carefully crafted file was opened by a victim, an attacker could use the flaw to crash OpenOffice.org or, possibly, execute arbitrary code. (CVE-2008-2152)

It was discovered that certain libraries in the Red Hat Enterprise Linux 3 and 4 openoffice.org packages had an insecure relative RPATH (runtime library search path) set in the ELF (Executable and Linking Format) header. A local user able to convince another user to run OpenOffice in an attacker-controlled directory, could run arbitrary code with the privileges of the victim. (CVE-2008-2366)

All users of openoffice.org are advised to upgrade to these updated packages, which contain backported fixes which correct these issues.

Sean Larsson found a heap overflow flaw in the OpenOffice memory allocator. If a carefully crafted file was opened by a victim, an attacker could usethe flaw to crash OpenOffice.org or, possibly, execute arbitrary code. (CVE-2008-2152)

Sean Larsson found a heap overflow flaw in the OpenOffice memory allocator. If a carefully crafted file was opened by a victim, an attacker could use the flaw to crash OpenOffice.org or, possibly, execute arbitrary code. (CVE-2008-2152)

It was discovered that certain libraries in the Scientific Linux 3 and 4 openoffice.org packages had an insecure relative RPATH (runtime library search path) set in the ELF (Executable and Linking Format) header. A local user able to convince another user to run OpenOffice in an attacker-controlled directory, could run arbitrary code with the privileges of the victim. (CVE-2008-2366)

Sean Larsson found a heap overflow flaw in the OpenOffice memory allocator. If a carefully crafted file was opened by a victim, an attacker could use the flaw to crash OpenOffice.org or, possibly, execute arbitrary code. (CVE-2008-2152)

Integer overflow in the rtl_allocateMemory function in sal/rtl/source/alloc_global.c in OpenOffice.org (OOo) 2.0 through 2.4 allows remote attackers to execute arbitrary code via a crafted file that triggers a heap-based buffer overflow. (CVE-2008-2152)

Also, according to bug #38874 decimal numbers on Hebrew documents would appear as Arabic characters. Another issue (#39799) is with measurements units configuration to format paragraphs on the menu:
(Tools -> Options -> OpenOffice.org Writer -> General). Even setting to centimeters on (Indent &amp; Spacing) option it shows as characters (ch) on (Indents &amp; Spacing) configuration on the menu: (Format -> Paragraph -> Indents &amp; Spacing). Moreover, a document holding Notes edited on Microsoft Office would not show when opened with OpenOffice.

These and a number of other OpenOffice.org issues were fixed by the new version provided in this update.

Integer overflow in the rtl_allocateMemory function in sal/rtl/source/alloc_global.c in OpenOffice.org (OOo) 2.0 through 2.4 allows remote attackers to execute arbitrary code via a crafted file that triggers a heap-based buffer overflow.

The updated packages have been patched to fix the issue.

The remote host is affected by the vulnerability described in GLSA-200807-05 (OpenOffice.org: User-assisted execution of arbitrary code)

    Sean Larsson (iDefense Labs) reported an integer overflow in the     function rtl_allocateMemory() in the file     sal/rtl/source/alloc_global.c.
  Impact :

    A remote attacker could entice a user to open a specially crafted     document, possibly resulting in the remote execution of arbitrary code     with the privileges of the user running the application.
  Workaround :

    There is no known workaround at this time.

Updated openoffice.org packages to correct a security issue are now available for Red Hat Enterprise Linux 4 and Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

OpenOffice.org is an office productivity suite that includes desktop applications such as a word processor, spreadsheet, presentation manager, formula editor, and drawing program.

Sean Larsson found a heap overflow flaw in the OpenOffice memory allocator. If a carefully crafted file was opened by a victim, an attacker could use the flaw to crash OpenOffice.org or, possibly, execute arbitrary code. (CVE-2008-2152)

All users of OpenOffice.org are advised to upgrade to these updated packages, which contain a backported fix to correct this issue.

Updated openoffice.org packages to correct two security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

OpenOffice.org is an office productivity suite that includes desktop applications such as a word processor, spreadsheet, presentation manager, formula editor, and drawing program.

Sean Larsson found a heap overflow flaw in the OpenOffice memory allocator. If a carefully crafted file was opened by a victim, an attacker could use the flaw to crash OpenOffice.org or, possibly, execute arbitrary code. (CVE-2008-2152)

It was discovered that certain libraries in the Red Hat Enterprise Linux 3 and 4 openoffice.org packages had an insecure relative RPATH (runtime library search path) set in the ELF (Executable and Linking Format) header. A local user able to convince another user to run OpenOffice in an attacker-controlled directory, could run arbitrary code with the privileges of the victim. (CVE-2008-2366)

All users of openoffice.org are advised to upgrade to these updated packages, which contain backported fixes which correct these issues.

Resolves CVE-2008-2152, a potential overflow in allocating memory

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to upstream version 2.4.1 to fix a range of reported problems and a security issue CVE-2008-2152:
http://www.openoffice.org/security/cves/CVE-2008-2152.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of OpenOffice installed on the remote host reportedly contains an integer overflow vulnerability in 'rtl_allocateMemory()', a custom memory allocation function used by the application.  If an attacker can trick a user on the affected system, he can leverage this issue to execute arbitrary code subject to his privileges.

ID	Name	Product	Family	Severity
67710	Oracle Linux 3 / 4 : openoffice.org (ELSA-2008-0538)	Nessus	Oracle Linux Local Security Checks	high
60426	Scientific Linux Security Update : openoffice.org on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60425	Scientific Linux Security Update : openoffice.org on SL3.x, SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60424	Scientific Linux Security Update : openoffice.org2 on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
37435	Mandriva Linux Security Advisory : openoffice.org (MDVSA-2008:137)	Nessus	Mandriva Local Security Checks	high
36830	Mandriva Linux Security Advisory : openoffice.org (MDVSA-2008:138)	Nessus	Mandriva Local Security Checks	high
33472	GLSA-200807-05 : OpenOffice.org: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
33366	CentOS 4 : openoffice.org2 (CESA-2008:0537)	Nessus	CentOS Local Security Checks	high
33192	RHEL 3 / 4 : openoffice.org (RHSA-2008:0538)	Nessus	Red Hat Local Security Checks	high
33191	RHEL 4 / 5 : openoffice.org (RHSA-2008:0537)	Nessus	Red Hat Local Security Checks	high
33172	CentOS 3 / 4 : openoffice.org (CESA-2008:0538)	Nessus	CentOS Local Security Checks	high
33150	Fedora 8 : openoffice.org-2.3.0-6.15.fc8 (2008-5247)	Nessus	Fedora Local Security Checks	high
33149	Fedora 7 : openoffice.org-2.3.0-6.9.fc7 (2008-5239)	Nessus	Fedora Local Security Checks	high
33145	Fedora 9 : openoffice.org-2.4.1-17.3.fc9 (2008-5143)	Nessus	Fedora Local Security Checks	high
33129	OpenOffice < 2.4.1 rtl_allocateMemory() Function Crafted Document Handling Integer Overflow	Nessus	Windows	high
4538	OpenOffice < 2.4.1 rtl_allocateMemory Integer Overflow	Nessus Network Monitor	Generic	medium

Detections

Analytics

CVE-2008-2152

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

medium