Detections
Analytics
Debian DSA-1880-1 : openoffice.org - several vulnerabilities
high Nessus Plugin ID 44745
Language:
Synopsis
The remote Debian host is missing a security-related update.Description
Several vulnerabilities have been discovered in the OpenOffice.org office suite. The Common Vulnerabilities and Exposures project identifies the following problems :- CVE-2009-0200 Dyon Balding of Secunia Research has discovered a vulnerability, which can be exploited by opening a specially crafted Microsoft Word document.
When reading a Microsoft Word document, a bug in the parser of sprmTDelete records can result in an integer underflow that may lead to heap-based buffer overflows.
Successful exploitation may allow arbitrary code execution in the context of the OpenOffice.org process.
- CVE-2009-0201 Dyon Balding of Secunia Research has discovered a vulnerability, which can be exploited by opening a specially crafted Microsoft Word document.
When reading a Microsoft Word document, a bug in the parser of sprmTDelete records can result in heap-based buffer overflows.
Successful exploitation may allow arbitrary code execution in the context of the OpenOffice.org process.
- CVE-2009-2139 A vulnerability has been discovered in the parser of EMF files of OpenOffice/Go-oo 2.x and 3.x that can be triggered by a specially crafted document and lead to the execution of arbitrary commands the privileges of the user running OpenOffice.org/Go-oo.
This vulnerability does not exist in the packages for oldstable, testing and unstable.
Solution
Upgrade the Openoffice.org package.For the old stable distribution (etch) these problems have been fixed in version 2.0.4.dfsg.2-7etch7.
For the stable distribution (lenny) these problems have been fixed in version 2.4.1+dfsg-1+lenny3 and higher.
See Also
https://security-tracker.debian.org/tracker/CVE-2009-0200
https://security-tracker.debian.org/tracker/CVE-2009-0201
Plugin Details
Severity: High
ID: 44745
File Name: debian_DSA-1880.nasl
Version: 1.13
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 2/24/2010
Updated: 1/4/2021
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 6.9
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: p-cpe:/a:debian:debian_linux:openoffice.org, cpe:/o:debian:debian_linux:4.0, cpe:/o:debian:debian_linux:5.0
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Ease: No known exploits are available
Patch Publication Date: 9/4/2009
Reference Information
CVE: CVE-2009-0200, CVE-2009-0201, CVE-2009-2139
BID: 36200