Multiple integer overflows in OpenOffice.org (OOo) 2.x before 2.4.2 allow remote attackers to execute arbitrary code via crafted EMR records in an EMF file associated with a StarOffice/StarSuite document, which trigger a heap-based buffer overflow.

From Red Hat Security Advisory 2008:0939 :

Updated openoffice.org packages that correct security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

OpenOffice.org is an office productivity suite that includes desktop applications such as a word processor, spreadsheet, presentation manager, formula editor, and drawing program.

SureRun Security Team discovered an integer overflow flaw leading to a heap buffer overflow in the Windows Metafile (WMF) image format parser. An attacker could create a carefully crafted document containing a malicious WMF file that could cause OpenOffice.org to crash, or, possibly, execute arbitrary code if opened by a victim.
(CVE-2008-2237)

Multiple integer overflow flaws were found in the Enhanced Windows Metafile (EMF) parser. An attacker could create a carefully crafted document containing a malicious EMF file that could cause OpenOffice.org to crash, or, possibly, execute arbitrary code if opened by a victim. (CVE-2008-2238)

All users of OpenOffice.org are advised to upgrade to these updated packages, which contain backported patches that correct these issues.

SureRun Security Team discovered an integer overflow flaw leading to a heap buffer overflow in the Windows Metafile (WMF) image format parser. An attacker could create a carefully crafted document containing a malicious WMF file that could cause OpenOffice.org to crash, or, possibly, execute arbitrary code if opened by a victim.
(CVE-2008-2237)

Multiple integer overflow flaws were found in the Enhanced Windows Metafile (EMF) parser. An attacker could create a carefully crafted document containing a malicious EMF file that could cause OpenOffice.org to crash, or, possibly, execute arbitrary code if opened by a victim. (CVE-2008-2238)

This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238).
Additionally multiple non-security fixes were added.

USN-677-1 fixed vulnerabilities in OpenOffice.org. The changes required that openoffice.org-l10n also be updated for the new version in Ubuntu 8.04 LTS.

Multiple memory overflow flaws were discovered in OpenOffice.org's handling of WMF and EMF files. If a user were tricked into opening a specially crafted document, a remote attacker might be able to execute arbitrary code with user privileges. (CVE-2008-2237, CVE-2008-2238)

Dmitry E. Oboukhov discovered that senddoc, as included in OpenOffice.org, created temporary files in an insecure way.
Local users could exploit a race condition to create or overwrite files with the privileges of the user invoking the program. This issue only affected Ubuntu 8.04 LTS.
(CVE-2008-4937).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated openoffice.org packages that correct security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

OpenOffice.org is an office productivity suite that includes desktop applications such as a word processor, spreadsheet, presentation manager, formula editor, and drawing program.

SureRun Security Team discovered an integer overflow flaw leading to a heap buffer overflow in the Windows Metafile (WMF) image format parser. An attacker could create a carefully crafted document containing a malicious WMF file that could cause OpenOffice.org to crash, or, possibly, execute arbitrary code if opened by a victim.
(CVE-2008-2237)

Multiple integer overflow flaws were found in the Enhanced Windows Metafile (EMF) parser. An attacker could create a carefully crafted document containing a malicious EMF file that could cause OpenOffice.org to crash, or, possibly, execute arbitrary code if opened by a victim. (CVE-2008-2238)

All users of OpenOffice.org are advised to upgrade to these updated packages, which contain backported patches that correct these issues.

Multiple memory overflow flaws were discovered in OpenOffice.org's handling of WMF and EMF files. If a user were tricked into opening a specially crafted document, a remote attacker might be able to execute arbitrary code with user privileges. (CVE-2008-2237, CVE-2008-2238)

Dmitry E. Oboukhov discovered that senddoc, as included in OpenOffice.org, created temporary files in an insecure way. Local users could exploit a race condition to create or overwrite files with the privileges of the user invoking the program. This issue only affected Ubuntu 8.04 LTS. (CVE-2008-4937).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Heap-based overflow on functions to manipulate WMF and EMF files in OpenOffice.org documments enables remote attackers to execute arbitrary code on documments holding certain crafted either WMF or EMF files (CVE-2008-2237) (CVE-2008-2238).

This update provide the fix for these security issues and further openoffice.org-voikko package has been updated as it depends on openoffice.org packages.

The remote host is affected by the vulnerability described in GLSA-200812-13 (OpenOffice.org: Multiple vulnerabilities)

    Two heap-based buffer overflows when processing WMF files     (CVE-2008-2237) and EMF files (CVE-2008-2238) were discovered. Dmitry     E. Oboukhov also reported an insecure temporary file usage within the     senddoc script (CVE-2008-4937).
  Impact :

    A remote attacker could entice a user to open a specially crafted     document, resulting in the remote execution of arbitrary code. A local     attacker could perform symlink attacks to overwrite arbitrary files on     the system. Both cases happen with the privileges of the user running     the application.
  Workaround :

    There is no known workaround at this time.

The OpenOffice Team reports :

A security vulnerability with the way OpenOffice 2.x process WMF files may allow a remote unprivileged user who provides a StarOffice/StarSuite document that is opened by a local user to execute arbitrary commands on the system with the privileges of the user running StarOffice/StarSuite. No working exploit is known right now.

A security vulnerability with the way OpenOffice 2.x process EMF files may allow a remote unprivileged user who provides a StarOffice/StarSuite document that is opened by a local user to execute arbitrary commands on the system with the privileges of the user running StarOffice/StarSuite. No working exploit is known right now.

This update fixes an integer overflow in the WMF handler (CVE-2008-2237) and multiple bugs in the EMF parser (CVE-2008-2238).
Additionally multiple non-security bugs were fixed.

A security release to address: - CVE-2008-2237: Manipulated WMF files
- CVE-2008-2238: Manipulated EMF files as described at http://www.openoffice.org/security/bulletin.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security update to address - CVE-2008-2237: Manipulated WMF files - CVE-2008-2238: Manipulated EMF files as described at http://www.openoffice.org/security/bulletin.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the OpenOffice.org office suite :

  - CVE-2008-2237     The SureRun Security team discovered a bug in the WMF     file parser that can be triggered by manipulated WMF     files and can lead to heap overflows and arbitrary code     execution.

  - CVE-2008-2238     An anonymous researcher working with the iDefense     discovered a bug in the EMF file parser that can be     triggered by manipulated EMF files and can lead to heap     overflows and arbitrary code execution.

 The version of OpenOffice 2.x installed on the remote host is earlier than 2.4.2.  Such versions are affected by several issues : 

  - Specially crafted WMF files can lead to heap-based overflows and arbitrary code execution (CVE-2008-2237).
  - Specially crafted EMF files can lead to heap-based overflows and arbitrary code execution (CVE-2008-2238).

The version of OpenOffice 2.x installed on the remote host is earlier than 2.4.2.  Such versions are affected by several issues :

  - Specially crafted WMF files can lead to heap-based     overflows and arbitrary code execution (CVE-2008-2237).

  - Specially crafted EMF files can lead to heap-based     overflows and arbitrary code execution (CVE-2008-2238).

ID	Name	Product	Family	Severity
67756	Oracle Linux 3 / 4 : openoffice.org (ELSA-2008-0939)	Nessus	Oracle Linux Local Security Checks	high
60490	Scientific Linux Security Update : openoffice.org on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60489	Scientific Linux Security Update : openoffice.org2 on SL45, 46, 47 i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
39899	openSUSE Security Update : OpenOffice_org (OpenOffice_org-288)	Nessus	SuSE Local Security Checks	high
37546	Ubuntu 8.04 LTS : openoffice.org-l10n update (USN-677-2)	Nessus	Ubuntu Local Security Checks	high
36765	CentOS 3 / 5 : openoffice.org (CESA-2008:0939)	Nessus	CentOS Local Security Checks	high
36611	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : openoffice.org, openoffice.org-amd64 vulnerabilities (USN-677-1)	Nessus	Ubuntu Local Security Checks	high
36505	Mandriva Linux Security Advisory : openoffice.org (MDVSA-2009:006)	Nessus	Mandriva Local Security Checks	high
35101	GLSA-200812-13 : OpenOffice.org: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
34979	FreeBSD : openoffice -- arbitrary code execution vulnerabilities (842bafdd-be2f-11dd-a578-0030843d3802)	Nessus	FreeBSD Local Security Checks	high
34844	SuSE 10 Security Update : OpenOffice_org (ZYPP Patch Number 5740)	Nessus	SuSE Local Security Checks	high
34843	openSUSE 10 Security Update : OpenOffice_org (OpenOffice_org-5738)	Nessus	SuSE Local Security Checks	high
34696	RHEL 3 / 4 / 5 : openoffice.org (RHSA-2008:0939)	Nessus	Red Hat Local Security Checks	high
34683	Fedora 8 : openoffice.org-2.3.0-6.17.fc8 (2008-9333)	Nessus	Fedora Local Security Checks	high
34681	Fedora 9 : openoffice.org-2.4.2-18.1.fc9 (2008-9313)	Nessus	Fedora Local Security Checks	high
34669	Debian DSA-1661-1 : openoffice.org - several vulnerabilities	Nessus	Debian Local Security Checks	high
4727	OpenOffice < 2.4.2 WMF and EMF File Handling Buffer Overflows	Nessus Network Monitor	Generic	medium
34510	OpenOffice < 2.4.2 WMF and EMF File Handling Buffer Overflows	Nessus	Windows	high

Detections

Analytics

CVE-2008-2238

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

medium

high