OpenOffice.org 2.x and 3.0 before 3.2.1 allows user-assisted remote attackers to bypass Python macro security restrictions and execute arbitrary Python code via a crafted OpenDocument Text (ODT) file that triggers code execution when the macro directory structure is previewed.

The remote host is affected by the vulnerability described in GLSA-201408-19 (OpenOffice, LibreOffice: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenOffice and       Libreoffice. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could entice a user to open a specially crafted file       using OpenOffice, possibly resulting in execution of arbitrary code with       the privileges of the process, a Denial of Service condition, execution       of arbitrary Python code, authentication bypass, or reading and writing       of arbitrary files.
  Workaround :

    There is no known workaround at this time.

A flaw was found in the way OpenOffice.org enforced a macro security setting for macros, written in the Python scripting language, that were embedded in OpenOffice.org documents. If a user were tricked into opening a specially crafted OpenOffice.org document and previewed the macro directory structure, it could lead to Python macro execution even if macro execution was disabled. (CVE-2010-0395)

All running instances of OpenOffice.org applications must be restarted for this update to take effect.

This update of OpenOffice_org fixes the following security issue :

  - Arbitrary macros written in Python can be executed by     bypassing macro security permissions. (CVE-2010-0395)

It also provides the maintenance update to OpenOffice.org-3.2.1.
Details about all upstream changes can be found at http://development.openoffice.org/releases/3.2.1.html .

For further SUSE Linux Enterprise specific fixes please refer to the changelog of the OpenOffice_org RPM package.

This update of OpenOffice_org fixes the following security issue :

  - Arbitrary macros written in Python can be executed by     bypassing macro security permissions. (CVE-2010-0395) It     also provides the maintenance update to     OpenOffice.org-3.2.1. Details about all upstream changes     can be found at     http://development.openoffice.org/releases/3.2.1.html .

For further SUSE Linux Enterprise specific fixes please refer to the changelog of the OpenOffice_org RPM package.

Multiple vulnerabilities was discovered and corrected in the OpenOffice.org :

Integer overflow allows remote attackers to execute arbitrary code via a crafted XPM file that triggers a heap-based buffer overflow (CVE-2009-2949).

Heap-based buffer overflow allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted GIF file, related to LZW decompression (CVE-2009-2950).

Integer underflow allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted sprmTDefTable table property modifier in a Word document (CVE-2009-3301).

boundary error flaw allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted sprmTSetBrc table property modifier in a Word document (CVE-2009-3302).

Lack of properly enforcing Visual Basic for Applications (VBA) macro security settings, which allows remote attackers to run arbitrary macros via a crafted document (CVE-2010-0136).

User-assisted remote attackers are able to bypass Python macro security restrictions and execute arbitrary Python code via a crafted OpenDocument Text (ODT) file that triggers code execution when the macro directory structure is previewed (CVE-2010-0395).

Impress module does not properly handle integer values associated with dictionary property items, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PowerPoint document that triggers a heap-based buffer overflow, related to an integer truncation error (CVE-2010-2935).

Integer overflow in the Impress allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted polygons in a PowerPoint document that triggers a heap-based buffer overflow (CVE-2010-2936).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

This update provides OpenOffice.org packages have been patched to correct these issues and additional dependent packages.

This update of OpenOffice_org does not allow macros written in Python to be executed without permission, CVE-2010-0395.

CVE-2010-0395: Security vulnerability in OpenOffice.org related to python scripting.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A security vulnerability in OpenOffice.org, related to python scripting, might lead to unexpected code execution when using the built-in scripting IDE for exploring python code.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated openoffice.org packages that fix one security issue are now available for Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

[Updated 16 June 2010] The packages list in this erratum has been updated to include missing packages for the 'Red Hat Enterprise Linux Server - Optional Desktop Productivity Applications' channel. No changes have been made to the original packages.

OpenOffice.org is an office productivity suite that includes desktop applications, such as a word processor, spreadsheet application, presentation manager, formula editor, and a drawing program.

A flaw was found in the way OpenOffice.org enforced a macro security setting for macros, written in the Python scripting language, that were embedded in OpenOffice.org documents. If a user were tricked into opening a specially crafted OpenOffice.org document and previewed the macro directory structure, it could lead to Python macro execution even if macro execution was disabled. (CVE-2010-0395)

All users of OpenOffice.org are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. For Red Hat Enterprise Linux 4, this erratum provides updated openoffice.org2 packages. For Red Hat Enterprise Linux 5, this erratum provides updated openoffice.org packages. All running instances of OpenOffice.org applications must be restarted for this update to take effect.

Marc Schoenefeld discovered that OpenOffice.org would run document macros from the macro browser, even when macros were disabled. If a user were tricked into opening a specially crafted document and examining a macro, a remote attacker could execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2010:0459 advisory.

    OpenOffice.org is an office productivity suite that includes desktop     applications, such as a word processor, spreadsheet application,     presentation manager, formula editor, and a drawing program.

    A flaw was found in the way OpenOffice.org enforced a macro security     setting for macros, written in the Python scripting language, that were     embedded in OpenOffice.org documents. If a user were tricked into opening     a specially-crafted OpenOffice.org document and previewed the macro     directory structure, it could lead to Python macro execution even if macro     execution was disabled. (CVE-2010-0395)

    All users of OpenOffice.org are advised to upgrade to these updated     packages, which contain a backported patch to correct this issue. For Red     Hat Enterprise Linux 4, this erratum provides updated openoffice.org2     packages. For Red Hat Enterprise Linux 5, this erratum provides updated     openoffice.org packages. All running instances of OpenOffice.org     applications must be restarted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that OpenOffice.org, a full-featured office productivity suite that provides a near drop-in replacement for Microsoft(r) Office, is not properly handling python macros embedded in an office document. This allows an attacker to perform user-assisted execution of arbitrary code in certain use cases of the python macro viewer component.

The version of OpenOffice installed on the remote host is earlier than 3.2.1.  Such version are affected by several issues :

  - There is a TLS/SSL renegotiation vulnerability in the included third-party OpenSSL library. (CVE-2009-3555)

  - There is a python scripting vulnerability which may lead to undesired code execution when using the OpenOffice scripting IDE. (CVE-2010-0395)

The version of Oracle OpenOffice.org installed on the remote host is prior to 3.2.1. It is, therefore, affected by several issues :

  - There is a TLS/SSL renegotiation vulnerability in the     included third-party OpenSSL library. (CVE-2009-3555)

  - There is a python scripting vulnerability that could     lead to undesired code execution when using the     OpenOffice scripting IDE. (CVE-2010-0395)

ID	Name	Product	Family	Severity
77467	GLSA-201408-19 : OpenOffice, LibreOffice: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
60799	Scientific Linux Security Update : openoffice.org on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60798	Scientific Linux Security Update : openoffice.org2 on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
51686	SuSE 10 Security Update : OpenOffice_org (ZYPP Patch Number 7079)	Nessus	SuSE Local Security Checks	high
51595	SuSE 11.1 Security Update : OpenOffice_org (SAT Patch Number 2586)	Nessus	SuSE Local Security Checks	high
50880	SuSE 11 / 11.1 Security Update : OpenOffice_org (SAT Patch Numbers 2586 / 2589)	Nessus	SuSE Local Security Checks	high
50879	SuSE 11 Security Update : OpenOffice_org (SAT Patch Number 2589)	Nessus	SuSE Local Security Checks	high
50503	Mandriva Linux Security Advisory : openoffice.org (MDVSA-2010:221)	Nessus	Mandriva Local Security Checks	high
47757	openSUSE Security Update : OpenOffice_org-base-drivers-postgresql (openSUSE-SU-2010:0386-1)	Nessus	SuSE Local Security Checks	high
47756	openSUSE Security Update : OpenOffice_org-base-drivers-postgresql (openSUSE-SU-2010:0386-1)	Nessus	SuSE Local Security Checks	high
47755	openSUSE Security Update : OpenOffice_org (openSUSE-SU-2010:0386-1)	Nessus	SuSE Local Security Checks	high
47545	Fedora 13 : openoffice.org-3.2.0-12.24.fc13 (2010-9633)	Nessus	Fedora Local Security Checks	high
47544	Fedora 11 : openoffice.org-3.1.1-19.13.fc11 (2010-9628)	Nessus	Fedora Local Security Checks	high
47543	Fedora 12 : openoffice.org-3.1.1-19.32.fc12 (2010-9576)	Nessus	Fedora Local Security Checks	high
47031	CentOS 5 : openoffice.org (CESA-2010:0459)	Nessus	CentOS Local Security Checks	high
46836	Ubuntu 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : openoffice.org vulnerability (USN-949-1)	Nessus	Ubuntu Local Security Checks	high
46835	RHEL 4 / 5 : openoffice.org (RHSA-2010:0459)	Nessus	Red Hat Local Security Checks	critical
46830	Debian DSA-2055-1 : openoffice.org - macro execution	Nessus	Debian Local Security Checks	high
5564	OpenOffice < 3.2.1 Multiple Vulnerabilities	Nessus Network Monitor	Generic	medium
46814	Oracle OpenOffice.org < 3.2.1 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2010-0395

critical

Tenable Plugins

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

critical

high

medium

high