senddoc in OpenOffice.org (OOo) 2.4.1 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/log.obr.##### temporary file.

USN-677-1 fixed vulnerabilities in OpenOffice.org. The changes required that openoffice.org-l10n also be updated for the new version in Ubuntu 8.04 LTS.

Multiple memory overflow flaws were discovered in OpenOffice.org's handling of WMF and EMF files. If a user were tricked into opening a specially crafted document, a remote attacker might be able to execute arbitrary code with user privileges. (CVE-2008-2237, CVE-2008-2238)

Dmitry E. Oboukhov discovered that senddoc, as included in OpenOffice.org, created temporary files in an insecure way.
Local users could exploit a race condition to create or overwrite files with the privileges of the user invoking the program. This issue only affected Ubuntu 8.04 LTS.
(CVE-2008-4937).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

senddoc uses temporary files (/tmp/log.obr.4043) in a insecure way which enables local attackers to overwrite arbitrary files by using a symlink attack (CVE-2008-4937).

This update provides fix for that vulnerability.

Update :

Further this update is a rebuild against (lastest) xulrunner 1.9.0.6.

Multiple memory overflow flaws were discovered in OpenOffice.org's handling of WMF and EMF files. If a user were tricked into opening a specially crafted document, a remote attacker might be able to execute arbitrary code with user privileges. (CVE-2008-2237, CVE-2008-2238)

Dmitry E. Oboukhov discovered that senddoc, as included in OpenOffice.org, created temporary files in an insecure way. Local users could exploit a race condition to create or overwrite files with the privileges of the user invoking the program. This issue only affected Ubuntu 8.04 LTS. (CVE-2008-4937).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200812-13 (OpenOffice.org: Multiple vulnerabilities)

    Two heap-based buffer overflows when processing WMF files     (CVE-2008-2237) and EMF files (CVE-2008-2238) were discovered. Dmitry     E. Oboukhov also reported an insecure temporary file usage within the     senddoc script (CVE-2008-4937).
  Impact :

    A remote attacker could entice a user to open a specially crafted     document, resulting in the remote execution of arbitrary code. A local     attacker could perform symlink attacks to overwrite arbitrary files on     the system. Both cases happen with the privileges of the user running     the application.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
37546	Ubuntu 8.04 LTS : openoffice.org-l10n update (USN-677-2)	Nessus	Ubuntu Local Security Checks	high
37049	Mandriva Linux Security Advisory : openoffice.org (MDVSA-2009:070)	Nessus	Mandriva Local Security Checks	low
36611	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : openoffice.org, openoffice.org-amd64 vulnerabilities (USN-677-1)	Nessus	Ubuntu Local Security Checks	high
35101	GLSA-200812-13 : OpenOffice.org: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2008-4937

medium

Tenable Plugins

high

low

high

high