OpenOffice.org (OOo) 2.0.4, 2.4.1, and 3.1.1 does not properly enforce Visual Basic for Applications (VBA) macro security settings, which allows remote attackers to run arbitrary macros via a crafted document.

This update of OpenOffice_org includes fixes for the following vulnerabilities :

  - XML signature weakness CVE-2009-2949: XPM Import Integer     Overflow CVE-2009-2950: GIF Import Heap Overflow     CVE-2009-3301: MS Word sprmTDefTable Memory Corruption     CVE-2009-3302: MS Word sprmTDefTable Memory Corruption     CVE-2010-0136: In the ooo-build variant of     OpenOffice_org VBA Macro support does not honor Macro     security settings. (CVE-2009-0217)

This also provides the maintenance update to OpenOffice.org-3.2.

This update of OpenOffice_org includes fixes for the following vulnerabilities :

  - XML signature weakness. (CVE-2009-0217)

  - XPM Import Integer Overflow. (CVE-2009-2949)

  - GIF Import Heap Overflow. (CVE-2009-2950)

  - MS Word sprmTDefTable Memory Corruption. (CVE-2009-3301)

  - MS Word sprmTDefTable Memory Corruption. (CVE-2009-3302)

  - In the ooo-build variant of OpenOffice_org VBA Macro     support does not honor Macro security settings.
    (CVE-2010-0136)

This also provides the maintenance update to OpenOffice.org-3.2.

Details about all upstream changes can be found at http://development.openoffice.org/releases/3.2.0.html

Multiple vulnerabilities was discovered and corrected in the OpenOffice.org :

Integer overflow allows remote attackers to execute arbitrary code via a crafted XPM file that triggers a heap-based buffer overflow (CVE-2009-2949).

Heap-based buffer overflow allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted GIF file, related to LZW decompression (CVE-2009-2950).

Integer underflow allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted sprmTDefTable table property modifier in a Word document (CVE-2009-3301).

boundary error flaw allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted sprmTSetBrc table property modifier in a Word document (CVE-2009-3302).

Lack of properly enforcing Visual Basic for Applications (VBA) macro security settings, which allows remote attackers to run arbitrary macros via a crafted document (CVE-2010-0136).

User-assisted remote attackers are able to bypass Python macro security restrictions and execute arbitrary Python code via a crafted OpenDocument Text (ODT) file that triggers code execution when the macro directory structure is previewed (CVE-2010-0395).

Impress module does not properly handle integer values associated with dictionary property items, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PowerPoint document that triggers a heap-based buffer overflow, related to an integer truncation error (CVE-2010-2935).

Integer overflow in the Impress allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted polygons in a PowerPoint document that triggers a heap-based buffer overflow (CVE-2010-2936).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

This update provides OpenOffice.org packages have been patched to correct these issues and additional dependent packages.

This update of OpenOffice_org includes fixes for the following vulnerabilities :

  - CVE-2009-0217: XML signature weakness

  - CVE-2009-2949: XPM Import Integer Overflow

  - CVE-2009-2950: GIF Import Heap Overflow

  - CVE-2009-3301: MS Word sprmTDefTable Memory Corruption

  - CVE-2009-3302: MS Word sprmTDefTable Memory Corruption

  - CVE-2010-0136: In the ooo-build variant of     OpenOffice_org VBA Macro support does not honor Macro     security settings.

It was discovered that the XML HMAC signature system did not correctly check certain lengths. If an attacker sent a truncated HMAC, it could bypass authentication, leading to potential privilege escalation.
(CVE-2009-0217)

Sebastian Apelt and Frank Reissner discovered that OpenOffice did not correctly import XPM and GIF images. If a user were tricked into opening a specially crafted image, an attacker could execute arbitrary code with user privileges. (CVE-2009-2949, CVE-2009-2950)

Nicolas Joly discovered that OpenOffice did not correctly handle certain Word documents. If a user were tricked into opening a specially crafted document, an attacker could execute arbitrary code with user privileges. (CVE-2009-3301, CVE-2009-3302)

It was discovered that OpenOffice did not correctly handle certain VBA macros correctly. If a user were tricked into opening a specially crafted document, an attacker could execute arbitrary macro commands, bypassing security controls. (CVE-2010-0136).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the OpenOffice.org office suite. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2010-0136     It was discovered that macro security settings were     insufficiently enforced for VBA macros.

  - CVE-2009-0217     It was discovered that the W3C XML Signature     recommendation contains a protocol-level vulnerability     related to HMAC output truncation. This also affects the     integrated libxmlsec library.

  - CVE-2009-2949     Sebastian Apelt discovered that an integer overflow in     the XPM import code may lead to the execution of     arbitrary code.

  - CVE-2009-2950     Sebastian Apelt and Frank Reissner discovered that a     buffer overflow in the GIF import code may lead to the     execution of arbitrary code.

  - CVE-2009-3301/ CVE-2009-3302     Nicolas Joly discovered multiple vulnerabilities in the     parser for Word document files, which may lead to the     execution of arbitrary code.

ID	Name	Product	Family	Severity
51685	SuSE 10 Security Update : OpenOffice_org (ZYPP Patch Number 6884)	Nessus	SuSE Local Security Checks	high
51684	SuSE 10 Security Update : OpenOffice_org (ZYPP Patch Number 6883)	Nessus	SuSE Local Security Checks	high
51594	SuSE 11 Security Update : OpenOffice_org (SAT Patch Number 2080)	Nessus	SuSE Local Security Checks	high
50503	Mandriva Linux Security Advisory : openoffice.org (MDVSA-2010:221)	Nessus	Mandriva Local Security Checks	high
45075	openSUSE Security Update : OpenOffice_org-base-drivers-postgresql (OpenOffice_org-base-drivers-postgresql-1980)	Nessus	SuSE Local Security Checks	high
45073	openSUSE Security Update : OpenOffice_org-base-drivers-postgresql (OpenOffice_org-base-drivers-postgresql-1981)	Nessus	SuSE Local Security Checks	high
45071	openSUSE Security Update : OpenOffice_org (OpenOffice_org-1979)	Nessus	SuSE Local Security Checks	high
45064	SuSE 11 Security Update : OpenOffice_org (SAT Patch Number 2080)	Nessus	SuSE Local Security Checks	high
44912	Ubuntu 8.04 LTS / 8.10 / 9.04 / 9.10 : openoffice.org vulnerabilities (USN-903-1)	Nessus	Ubuntu Local Security Checks	high
44859	Debian DSA-1995-1 : openoffice.org - several vulnerabilities	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2010-0136

medium

Tenable Plugins

high

high

high

high

high

high

high

high

high

high