simpress.bin in the Impress module in OpenOffice.org (OOo) 2.x and 3.x before 3.3 does not properly handle integer values associated with dictionary property items, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PowerPoint document that triggers a heap-based buffer overflow, related to an "integer truncation error."

The remote host is affected by the vulnerability described in GLSA-201408-19 (OpenOffice, LibreOffice: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenOffice and       Libreoffice. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could entice a user to open a specially crafted file       using OpenOffice, possibly resulting in execution of arbitrary code with       the privileges of the process, a Denial of Service condition, execution       of arbitrary Python code, authentication bypass, or reading and writing       of arbitrary files.
  Workaround :

    There is no known workaround at this time.

Specially crafted ppt files could cause a heap based buffer overflow in OpenOffice_org Impress. Attackers could exploit that to crash OpenOffice_org or potentially even execute arbitrary code (CVE-2010-2935, CVE-2010-2936).

From Red Hat Security Advisory 2010:0643 :

Updated openoffice.org packages that fix two security issues are now available for Red Hat Enterprise Linux 3 and 4.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

OpenOffice.org is an office productivity suite that includes desktop applications, such as a word processor, spreadsheet application, presentation manager, formula editor, and a drawing program.

An integer truncation error, leading to a heap-based buffer overflow, was found in the way the OpenOffice.org Impress presentation application sanitized a file's dictionary property items. An attacker could use this flaw to create a specially crafted Microsoft Office PowerPoint file that, when opened, would cause OpenOffice.org Impress to crash or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org Impress. (CVE-2010-2935)

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way OpenOffice.org Impress processed polygons in input documents. An attacker could use this flaw to create a specially crafted Microsoft Office PowerPoint file that, when opened, would cause OpenOffice.org Impress to crash or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org Impress.
(CVE-2010-2936)

All users of OpenOffice.org are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
For Red Hat Enterprise Linux 3, this erratum provides updated openoffice.org packages. For Red Hat Enterprise Linux 4, this erratum provides updated openoffice.org and openoffice.org2 packages. All running instances of OpenOffice.org applications must be restarted for this update to take effect.

An integer truncation error, leading to a heap-based buffer overflow, was found in the way the OpenOffice.org Impress presentation application sanitized a file's dictionary property items. An attacker could use this flaw to create a specially crafted Microsoft Office PowerPoint file that, when opened, would cause OpenOffice.org Impress to crash or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org Impress. (CVE-2010-2935)

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way OpenOffice.org Impress processed polygons in input documents. An attacker could use this flaw to create a specially crafted Microsoft Office PowerPoint file that, when opened, would cause OpenOffice.org Impress to crash or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org Impress.
(CVE-2010-2936)

An integer truncation error, leading to a heap-based buffer overflow, was found in the way the OpenOffice.org Impress presentation application sanitized a file's dictionary property items. An attacker could use this flaw to create a specially crafted Microsoft Office PowerPoint file that, when opened, would cause OpenOffice.org Impress to crash or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org Impress. (CVE-2010-2935)

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way OpenOffice.org Impress processed polygons in input documents. An attacker could use this flaw to create a specially crafted Microsoft Office PowerPoint file that, when opened, would cause OpenOffice.org Impress to crash or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org Impress.
(CVE-2010-2936)

All running instances of OpenOffice.org applications must be restarted for this update to take effect.

Charlie Miller discovered several heap overflows in PPT processing. If a user or automated system were tricked into opening a specially crafted PPT document, a remote attacker could execute arbitrary code with user privileges. Ubuntu 10.10 was not affected. (CVE-2010-2935, CVE-2010-2936)

Marc Schoenefeld discovered that directory traversal was not correctly handled in XSLT, OXT, JAR, or ZIP files. If a user or automated system were tricked into opening a specially crafted document, a remote attacker overwrite arbitrary files, possibly leading to arbitrary code execution with user privileges. (CVE-2010-3450)

Dan Rosenberg discovered multiple heap overflows in RTF and DOC processing. If a user or automated system were tricked into opening a specially crafted RTF or DOC document, a remote attacker could execute arbitrary code with user privileges. (CVE-2010-3451, CVE-2010-3452, CVE-2010-3453, CVE-2010-3454)

Dmitri Gribenko discovered that OpenOffice.org did not correctly handle LD_LIBRARY_PATH in various tools. If a local attacker tricked a user or automated system into using OpenOffice.org from an attacker-controlled directory, they could execute arbitrary code with user privileges. (CVE-2010-3689)

Marc Schoenefeld discovered that OpenOffice.org did not correctly process PNG images. If a user or automated system were tricked into opening a specially crafted document, a remote attacker could execute arbitrary code with user privileges. (CVE-2010-4253)

It was discovered that OpenOffice.org did not correctly process TGA images. If a user or automated system were tricked into opening a specially crafted document, a remote attacker could execute arbitrary code with user privileges. (CVE-2010-4643).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of OpenOffice earlier than 3.3 are potentially affected by several issues :

  - Issues exist relating to PowerPoint document parsing that may lead to arbitrary code execution. (CVE-2010-2935, CVE-2010-2936)

  - A directory traversal vulnerability exists in zip / jar package extraction. (CVE-2010-3450)

  - Issues exist relating to RTF document processing that may lead to arbitrary code execution. (CVE-2010-3451, CVE-2010-3452)

  - Issues exist relating to Word document processing that may lead to arbitrary code execution. (CVE-2010-3453, CVE-2010-3454)

  - The OpenOffice.org start script and other shell scripts expand the LD_LIBRARY_PATH in a way that the current directory might be searched for libraries before /lib and /usr/lib. (CVE-2010-3689)

  - Issues exist in the third party XPDF library relating to PDf processing that may allow arbitrary code execution. (CVE-2010-3702, CVE-2010-3704)

  - OpenOffice.org includes a version of LIBXML2 that is affected by multiple vulnerabilities. (CVE-2010-4008, CVE-2010-4494)

  - An issue exists with PNG file processing that may allow arbitrary code execution. (CVE-2010-4253)

  - An issue exists with TGA file processing that may allow arbitrary code execution. (CVE-2010-4643)

The version of Oracle OpenOffice.org installed on the remote host is prior to 3.3. It is, therefore, affected by several issues :

  - Issues exist relating to PowerPoint document processing     that may lead to arbitrary code execution.
    (CVE-2010-2935, CVE-2010-2936)

  - A directory traversal vulnerability exists in zip / jar     package extraction. (CVE-2010-3450)

  - Issues exist relating to RTF document processing that     may lead to arbitrary code execution. (CVE-2010-3451,     CVE-2010-3452)

  - Issues exist relating to Word document processing that     may lead to arbitrary code execution. (CVE-2010-3453,     CVE-2010-3454)

  - Issues exist in the third-party XPDF library relating     to PDF document processing that may allow arbitrary code     execution. (CVE-2010-3702, CVE-2010-3704)

  - OpenOffice.org includes a version of LIBXML2 that is     affected by multiple vulnerabilities. (CVE-2010-4008,     CVE-2010-4494)

  - An issue exists with PNG file processing that may allow     arbitrary code execution. (CVE-2010-4253)

  - An issue exists with TGA file processing that may allow     arbitrary code execution. (CVE-2010-4643)

Specially crafted ppt files could cause a heap-based buffer overflow in OpenOffice_org Impress. Attackers could exploit that to crash OpenOffice_org or potentially even execute arbitrary code.
(CVE-2010-2935 / CVE-2010-2936)

This update also fixes numerous non-security bugs. Please refer to the package changelog for details.

Multiple vulnerabilities was discovered and corrected in the OpenOffice.org :

Integer overflow allows remote attackers to execute arbitrary code via a crafted XPM file that triggers a heap-based buffer overflow (CVE-2009-2949).

Heap-based buffer overflow allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted GIF file, related to LZW decompression (CVE-2009-2950).

Integer underflow allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted sprmTDefTable table property modifier in a Word document (CVE-2009-3301).

boundary error flaw allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted sprmTSetBrc table property modifier in a Word document (CVE-2009-3302).

Lack of properly enforcing Visual Basic for Applications (VBA) macro security settings, which allows remote attackers to run arbitrary macros via a crafted document (CVE-2010-0136).

User-assisted remote attackers are able to bypass Python macro security restrictions and execute arbitrary Python code via a crafted OpenDocument Text (ODT) file that triggers code execution when the macro directory structure is previewed (CVE-2010-0395).

Impress module does not properly handle integer values associated with dictionary property items, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PowerPoint document that triggers a heap-based buffer overflow, related to an integer truncation error (CVE-2010-2935).

Integer overflow in the Impress allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted polygons in a PowerPoint document that triggers a heap-based buffer overflow (CVE-2010-2936).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

This update provides OpenOffice.org packages have been patched to correct these issues and additional dependent packages.

Charlie Miller has discovered two vulnerabilities in OpenOffice.org Impress, which can be exploited by malicious people to compromise a user's system and execute arbitrary code.

  - An integer truncation error when parsing certain content     can be exploited to cause a heap-based buffer overflow     via a specially crafted file.
  - A short integer overflow error when parsing certain     content can be exploited to cause a heap-based buffer     overflow via a specially crafted file.

Updated openoffice.org packages that fix two security issues are now available for Red Hat Enterprise Linux 3 and 4.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

OpenOffice.org is an office productivity suite that includes desktop applications, such as a word processor, spreadsheet application, presentation manager, formula editor, and a drawing program.

An integer truncation error, leading to a heap-based buffer overflow, was found in the way the OpenOffice.org Impress presentation application sanitized a file's dictionary property items. An attacker could use this flaw to create a specially crafted Microsoft Office PowerPoint file that, when opened, would cause OpenOffice.org Impress to crash or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org Impress. (CVE-2010-2935)

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way OpenOffice.org Impress processed polygons in input documents. An attacker could use this flaw to create a specially crafted Microsoft Office PowerPoint file that, when opened, would cause OpenOffice.org Impress to crash or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org Impress.
(CVE-2010-2936)

All users of OpenOffice.org are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
For Red Hat Enterprise Linux 3, this erratum provides updated openoffice.org packages. For Red Hat Enterprise Linux 4, this erratum provides updated openoffice.org and openoffice.org2 packages. All running instances of OpenOffice.org applications must be restarted for this update to take effect.

ID	Name	Product	Family	Severity
77467	GLSA-201408-19 : OpenOffice, LibreOffice: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
75688	openSUSE Security Update : OpenOffice_org-draw (openSUSE-SU-2010:0732-1)	Nessus	SuSE Local Security Checks	high
75687	openSUSE Security Update : OpenOffice_org (openSUSE-SU-2011:0336-1)	Nessus	SuSE Local Security Checks	high
68087	Oracle Linux 3 / 4 : openoffice.org (ELSA-2010-0643)	Nessus	Oracle Linux Local Security Checks	high
60841	Scientific Linux Security Update : openoffice.org on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60840	Scientific Linux Security Update : openoffice.org on SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60839	Scientific Linux Security Update : openoffice.org2 on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
53784	openSUSE Security Update : OpenOffice_org (openSUSE-SU-2011:0337-1)	Nessus	SuSE Local Security Checks	high
52738	SuSE 10 Security Update : Libreoffice (ZYPP Patch Number 7365)	Nessus	SuSE Local Security Checks	high
52735	SuSE 11.1 Security Update : Libreoffice (SAT Patch Number 4082)	Nessus	SuSE Local Security Checks	high
51858	Ubuntu 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : openoffice.org vulnerabilities (USN-1056-1)	Nessus	Ubuntu Local Security Checks	high
5745	OpenOffice < 3.3 Multiple Vulnerabilities	Nessus Network Monitor	Generic	high
51773	Oracle OpenOffice.org < 3.3 Multiple Vulnerabilities	Nessus	Windows	high
51687	SuSE 10 Security Update : OpenOffice_org (ZYPP Patch Number 7148)	Nessus	SuSE Local Security Checks	high
50878	SuSE 11 / 11.1 Security Update : OpenOffice_org (SAT Patch Numbers 3087 / 3089)	Nessus	SuSE Local Security Checks	high
50503	Mandriva Linux Security Advisory : openoffice.org (MDVSA-2010:221)	Nessus	Mandriva Local Security Checks	high
50018	openSUSE Security Update : OpenOffice_org-draw (openSUSE-SU-2010:0732-1)	Nessus	SuSE Local Security Checks	high
50012	openSUSE Security Update : OpenOffice_org-draw (openSUSE-SU-2010:0732-1)	Nessus	SuSE Local Security Checks	high
48928	Debian DSA-2099-1 : openoffice.org - buffer overflows	Nessus	Debian Local Security Checks	high
48742	CentOS 3 / 4 : openoffice.org (CESA-2010:0643)	Nessus	CentOS Local Security Checks	high
48423	RHEL 3 / 4 : openoffice.org (RHSA-2010:0643)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2010-2935

high

Tenable Plugins

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high