(Red Hat Issues Fix) OpenOffice StgCompObjStream::Load() Heap Overflow Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1013818 |
|
SecurityTracker URL: http://securitytracker.com/id/1013818
|
|
CVE Reference:
CAN-2005-0941
(Links to External Site)
|
Date: Apr 26 2005
|
Impact:
Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 1.1.4 and prior versions; 2.0dev
|
Description:
A buffer overflow vulnerability was reported in OpenOffice in the processing of 'DOC' documents. A remote user can create a document that, when processed, will execute arbitrary code.
The StgCompObjStream::Load() function incorrectly allocates memory based on user-supplied information contained in 'DOC' formatted files. A remote user can create a specially crafted document that, when processed by the target user with OpenOffice, will cause arbitrary code to be executed on the target user's system. The code will run with the privileges of the target user.
AD-LAB discovered this vulnerability. VENUSTECH reported this vulnerability.
|
Impact:
A remote user can create a document that, when processed by the target user, will execute arbitrary code with the privileges of the target user.
|
Solution:
Red Hat has issued a fix.
Red Hat Desktop (v. 3)
--------------------------------------------------------------------------------
SRPMS:
openoffice.org-1.1.2-24.2.0.EL3.src.rpm 28b62078a887294f683d0ef33c4fb7d8
IA-32:
openoffice.org-1.1.2-24.2.0.EL3.i386.rpm 3fb7f2cc17fdbac1690731032438fa2a
openoffice.org-i18n-1.1.2-24.2.0.EL3.i386.rpm 2e5336c39975c611ffa23145d9985dbb
openoffice.org-libs-1.1.2-24.2.0.EL3.i386.rpm afa55ff288e8fa052fada08cc0a56235
x86_64:
openoffice.org-1.1.2-24.2.0.EL3.i386.rpm 3fb7f2cc17fdbac1690731032438fa2a
openoffice.org-i18n-1.1.2-24.2.0.EL3.i386.rpm 2e5336c39975c611ffa23145d9985dbb
openoffice.org-libs-1.1.2-24.2.0.EL3.i386.rpm afa55ff288e8fa052fada08cc0a56235
Red Hat Desktop (v. 4)
--------------------------------------------------------------------------------
SRPMS:
openoffice.org-1.1.2-24.6.0.EL4.src.rpm 782df44227035bdae27f4d5b82548244
IA-32:
openoffice.org-1.1.2-24.6.0.EL4.i386.rpm 700fc3a6036a9206f31bd7d9ac7db80c
openoffice.org-i18n-1.1.2-24.6.0.EL4.i386.rpm 9dc5d0f31383ea144f216c7bfe18efa2
openoffice.org-kde-1.1.2-24.6.0.EL4.i386.rpm 93e50067e6aa036fb4356846b61d730e
openoffice.org-libs-1.1.2-24.6.0.EL4.i386.rpm fb4760c12f39bdea783d35ddecdf7ff7
x86_64:
openoffice.org-1.1.2-24.6.0.EL4.i386.rpm 700fc3a6036a9206f31bd7d9ac7db80c
openoffice.org-i18n-1.1.2-24.6.0.EL4.i386.rpm 9dc5d0f31383ea144f216c7bfe18efa2
openoffice.org-libs-1.1.2-24.6.0.EL4.i386.rpm fb4760c12f39bdea783d35ddecdf7ff7
Red Hat Enterprise Linux AS (v. 3)
--------------------------------------------------------------------------------
SRPMS:
openoffice.org-1.1.2-24.2.0.EL3.src.rpm 28b62078a887294f683d0ef33c4fb7d8
IA-32:
openoffice.org-1.1.2-24.2.0.EL3.i386.rpm 3fb7f2cc17fdbac1690731032438fa2a
openoffice.org-i18n-1.1.2-24.2.0.EL3.i386.rpm 2e5336c39975c611ffa23145d9985dbb
openoffice.org-libs-1.1.2-24.2.0.EL3.i386.rpm afa55ff288e8fa052fada08cc0a56235
x86_64:
openoffice.org-1.1.2-24.2.0.EL3.i386.rpm 3fb7f2cc17fdbac1690731032438fa2a
openoffice.org-i18n-1.1.2-24.2.0.EL3.i386.rpm 2e5336c39975c611ffa23145d9985dbb
openoffice.org-libs-1.1.2-24.2.0.EL3.i386.rpm afa55ff288e8fa052fada08cc0a56235
Red Hat Enterprise Linux AS (v. 4)
--------------------------------------------------------------------------------
SRPMS:
openoffice.org-1.1.2-24.6.0.EL4.src.rpm 782df44227035bdae27f4d5b82548244
IA-32:
openoffice.org-1.1.2-24.6.0.EL4.i386.rpm 700fc3a6036a9206f31bd7d9ac7db80c
openoffice.org-i18n-1.1.2-24.6.0.EL4.i386.rpm 9dc5d0f31383ea144f216c7bfe18efa2
openoffice.org-kde-1.1.2-24.6.0.EL4.i386.rpm 93e50067e6aa036fb4356846b61d730e
openoffice.org-libs-1.1.2-24.6.0.EL4.i386.rpm fb4760c12f39bdea783d35ddecdf7ff7
PPC:
openoffice.org-1.1.2-24.6.0.EL4.ppc.rpm 9f9b16a868bac28eea5ae035a41da178
openoffice.org-i18n-1.1.2-24.6.0.EL4.ppc.rpm 0bb909a3756f7256d5016cb4e8135906
openoffice.org-kde-1.1.2-24.6.0.EL4.ppc.rpm 92b028f02db5c193274486119c9ec763
openoffice.org-libs-1.1.2-24.6.0.EL4.ppc.rpm 02e37584c158d993c83d72dfbdc4f265
x86_64:
openoffice.org-1.1.2-24.6.0.EL4.i386.rpm 700fc3a6036a9206f31bd7d9ac7db80c
openoffice.org-i18n-1.1.2-24.6.0.EL4.i386.rpm 9dc5d0f31383ea144f216c7bfe18efa2
openoffice.org-libs-1.1.2-24.6.0.EL4.i386.rpm fb4760c12f39bdea783d35ddecdf7ff7
Red Hat Enterprise Linux ES (v. 3)
--------------------------------------------------------------------------------
SRPMS:
openoffice.org-1.1.2-24.2.0.EL3.src.rpm 28b62078a887294f683d0ef33c4fb7d8
IA-32:
openoffice.org-1.1.2-24.2.0.EL3.i386.rpm 3fb7f2cc17fdbac1690731032438fa2a
openoffice.org-i18n-1.1.2-24.2.0.EL3.i386.rpm 2e5336c39975c611ffa23145d9985dbb
openoffice.org-libs-1.1.2-24.2.0.EL3.i386.rpm afa55ff288e8fa052fada08cc0a56235
x86_64:
openoffice.org-1.1.2-24.2.0.EL3.i386.rpm 3fb7f2cc17fdbac1690731032438fa2a
openoffice.org-i18n-1.1.2-24.2.0.EL3.i386.rpm 2e5336c39975c611ffa23145d9985dbb
openoffice.org-libs-1.1.2-24.2.0.EL3.i386.rpm afa55ff288e8fa052fada08cc0a56235
Red Hat Enterprise Linux ES (v. 4)
--------------------------------------------------------------------------------
SRPMS:
openoffice.org-1.1.2-24.6.0.EL4.src.rpm 782df44227035bdae27f4d5b82548244
IA-32:
openoffice.org-1.1.2-24.6.0.EL4.i386.rpm 700fc3a6036a9206f31bd7d9ac7db80c
openoffice.org-i18n-1.1.2-24.6.0.EL4.i386.rpm 9dc5d0f31383ea144f216c7bfe18efa2
openoffice.org-kde-1.1.2-24.6.0.EL4.i386.rpm 93e50067e6aa036fb4356846b61d730e
openoffice.org-libs-1.1.2-24.6.0.EL4.i386.rpm fb4760c12f39bdea783d35ddecdf7ff7
x86_64:
openoffice.org-1.1.2-24.6.0.EL4.i386.rpm 700fc3a6036a9206f31bd7d9ac7db80c
openoffice.org-i18n-1.1.2-24.6.0.EL4.i386.rpm 9dc5d0f31383ea144f216c7bfe18efa2
openoffice.org-libs-1.1.2-24.6.0.EL4.i386.rpm fb4760c12f39bdea783d35ddecdf7ff7
Red Hat Enterprise Linux WS (v. 3)
--------------------------------------------------------------------------------
SRPMS:
openoffice.org-1.1.2-24.2.0.EL3.src.rpm 28b62078a887294f683d0ef33c4fb7d8
IA-32:
openoffice.org-1.1.2-24.2.0.EL3.i386.rpm 3fb7f2cc17fdbac1690731032438fa2a
openoffice.org-i18n-1.1.2-24.2.0.EL3.i386.rpm 2e5336c39975c611ffa23145d9985dbb
openoffice.org-libs-1.1.2-24.2.0.EL3.i386.rpm afa55ff288e8fa052fada08cc0a56235
x86_64:
openoffice.org-1.1.2-24.2.0.EL3.i386.rpm 3fb7f2cc17fdbac1690731032438fa2a
openoffice.org-i18n-1.1.2-24.2.0.EL3.i386.rpm 2e5336c39975c611ffa23145d9985dbb
openoffice.org-libs-1.1.2-24.2.0.EL3.i386.rpm afa55ff288e8fa052fada08cc0a56235
Red Hat Enterprise Linux WS (v. 4)
--------------------------------------------------------------------------------
SRPMS:
openoffice.org-1.1.2-24.6.0.EL4.src.rpm 782df44227035bdae27f4d5b82548244
IA-32:
openoffice.org-1.1.2-24.6.0.EL4.i386.rpm 700fc3a6036a9206f31bd7d9ac7db80c
openoffice.org-i18n-1.1.2-24.6.0.EL4.i386.rpm 9dc5d0f31383ea144f216c7bfe18efa2
openoffice.org-kde-1.1.2-24.6.0.EL4.i386.rpm 93e50067e6aa036fb4356846b61d730e
openoffice.org-libs-1.1.2-24.6.0.EL4.i386.rpm fb4760c12f39bdea783d35ddecdf7ff7
x86_64:
openoffice.org-1.1.2-24.6.0.EL4.i386.rpm 700fc3a6036a9206f31bd7d9ac7db80c
openoffice.org-i18n-1.1.2-24.6.0.EL4.i386.rpm 9dc5d0f31383ea144f216c7bfe18efa2
openoffice.org-libs-1.1.2-24.6.0.EL4.i386.rpm fb4760c12f39bdea783d35ddecdf7ff7
|
Vendor URL: www.openoffice.org/ (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS:
Linux (Red Hat Enterprise)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Tue, 26 Apr 2005 02:35:20 -0400
Subject: http://rhn.redhat.com/errata/RHSA-2005-375.html
|
Important: openoffice.org security update
Advisory: RHSA-2005:375-07
Type: Security Advisory
Issued on: 2005-04-25
Last updated on: 2005-04-25
Affected Products: Red Hat Desktop (v. 3)
Red Hat Desktop (v. 4)
Red Hat Enterprise Linux AS (v. 3)
Red Hat Enterprise Linux AS (v. 4)
Red Hat Enterprise Linux ES (v. 3)
Red Hat Enterprise Linux ES (v. 4)
Red Hat Enterprise Linux WS (v. 3)
Red Hat Enterprise Linux WS (v. 4)
CVEs (cve.mitre.org): CAN-2005-0941
Details
Updated openoffice.org packages are now available.
This update has been rated as having important security impact by the Red
Hat Security Response Team.
OpenOffice.org is an office productivity suite that includes desktop
applications such as a word processor, spreadsheet, presentation manager,
formula editor, and drawing program.
A heap based buffer overflow bug was found in the OpenOffice.org DOC file
processor. An attacker could create a carefully crafted DOC file in such a
way that it could cause OpenOffice.org to execute arbitrary code when the
file was opened by a victim. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CAN-2005-0941 to this issue.
All users of OpenOffice.org are advised to upgrade to these updated
packages, which contain backported fixes for these issues.
Solution
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
Updated packages
Red Hat Desktop (v. 3)
--------------------------------------------------------------------------------
SRPMS:
openoffice.org-1.1.2-24.2.0.EL3.src.rpm 28b62078a887294f683d0ef33c4fb7d8
IA-32:
openoffice.org-1.1.2-24.2.0.EL3.i386.rpm 3fb7f2cc17fdbac1690731032438fa2a
openoffice.org-i18n-1.1.2-24.2.0.EL3.i386.rpm 2e5336c39975c611ffa23145d9985dbb
openoffice.org-libs-1.1.2-24.2.0.EL3.i386.rpm afa55ff288e8fa052fada08cc0a56235
x86_64:
openoffice.org-1.1.2-24.2.0.EL3.i386.rpm 3fb7f2cc17fdbac1690731032438fa2a
openoffice.org-i18n-1.1.2-24.2.0.EL3.i386.rpm 2e5336c39975c611ffa23145d9985dbb
openoffice.org-libs-1.1.2-24.2.0.EL3.i386.rpm afa55ff288e8fa052fada08cc0a56235
Red Hat Desktop (v. 4)
--------------------------------------------------------------------------------
SRPMS:
openoffice.org-1.1.2-24.6.0.EL4.src.rpm 782df44227035bdae27f4d5b82548244
IA-32:
openoffice.org-1.1.2-24.6.0.EL4.i386.rpm 700fc3a6036a9206f31bd7d9ac7db80c
openoffice.org-i18n-1.1.2-24.6.0.EL4.i386.rpm 9dc5d0f31383ea144f216c7bfe18efa2
openoffice.org-kde-1.1.2-24.6.0.EL4.i386.rpm 93e50067e6aa036fb4356846b61d730e
openoffice.org-libs-1.1.2-24.6.0.EL4.i386.rpm fb4760c12f39bdea783d35ddecdf7ff7
x86_64:
openoffice.org-1.1.2-24.6.0.EL4.i386.rpm 700fc3a6036a9206f31bd7d9ac7db80c
openoffice.org-i18n-1.1.2-24.6.0.EL4.i386.rpm 9dc5d0f31383ea144f216c7bfe18efa2
openoffice.org-libs-1.1.2-24.6.0.EL4.i386.rpm fb4760c12f39bdea783d35ddecdf7ff7
Red Hat Enterprise Linux AS (v. 3)
--------------------------------------------------------------------------------
SRPMS:
openoffice.org-1.1.2-24.2.0.EL3.src.rpm 28b62078a887294f683d0ef33c4fb7d8
IA-32:
openoffice.org-1.1.2-24.2.0.EL3.i386.rpm 3fb7f2cc17fdbac1690731032438fa2a
openoffice.org-i18n-1.1.2-24.2.0.EL3.i386.rpm 2e5336c39975c611ffa23145d9985dbb
openoffice.org-libs-1.1.2-24.2.0.EL3.i386.rpm afa55ff288e8fa052fada08cc0a56235
x86_64:
openoffice.org-1.1.2-24.2.0.EL3.i386.rpm 3fb7f2cc17fdbac1690731032438fa2a
openoffice.org-i18n-1.1.2-24.2.0.EL3.i386.rpm 2e5336c39975c611ffa23145d9985dbb
openoffice.org-libs-1.1.2-24.2.0.EL3.i386.rpm afa55ff288e8fa052fada08cc0a56235
Red Hat Enterprise Linux AS (v. 4)
--------------------------------------------------------------------------------
SRPMS:
openoffice.org-1.1.2-24.6.0.EL4.src.rpm 782df44227035bdae27f4d5b82548244
IA-32:
openoffice.org-1.1.2-24.6.0.EL4.i386.rpm 700fc3a6036a9206f31bd7d9ac7db80c
openoffice.org-i18n-1.1.2-24.6.0.EL4.i386.rpm 9dc5d0f31383ea144f216c7bfe18efa2
openoffice.org-kde-1.1.2-24.6.0.EL4.i386.rpm 93e50067e6aa036fb4356846b61d730e
openoffice.org-libs-1.1.2-24.6.0.EL4.i386.rpm fb4760c12f39bdea783d35ddecdf7ff7
PPC:
openoffice.org-1.1.2-24.6.0.EL4.ppc.rpm 9f9b16a868bac28eea5ae035a41da178
openoffice.org-i18n-1.1.2-24.6.0.EL4.ppc.rpm 0bb909a3756f7256d5016cb4e8135906
openoffice.org-kde-1.1.2-24.6.0.EL4.ppc.rpm 92b028f02db5c193274486119c9ec763
openoffice.org-libs-1.1.2-24.6.0.EL4.ppc.rpm 02e37584c158d993c83d72dfbdc4f265
x86_64:
openoffice.org-1.1.2-24.6.0.EL4.i386.rpm 700fc3a6036a9206f31bd7d9ac7db80c
openoffice.org-i18n-1.1.2-24.6.0.EL4.i386.rpm 9dc5d0f31383ea144f216c7bfe18efa2
openoffice.org-libs-1.1.2-24.6.0.EL4.i386.rpm fb4760c12f39bdea783d35ddecdf7ff7
Red Hat Enterprise Linux ES (v. 3)
--------------------------------------------------------------------------------
SRPMS:
openoffice.org-1.1.2-24.2.0.EL3.src.rpm 28b62078a887294f683d0ef33c4fb7d8
IA-32:
openoffice.org-1.1.2-24.2.0.EL3.i386.rpm 3fb7f2cc17fdbac1690731032438fa2a
openoffice.org-i18n-1.1.2-24.2.0.EL3.i386.rpm 2e5336c39975c611ffa23145d9985dbb
openoffice.org-libs-1.1.2-24.2.0.EL3.i386.rpm afa55ff288e8fa052fada08cc0a56235
x86_64:
openoffice.org-1.1.2-24.2.0.EL3.i386.rpm 3fb7f2cc17fdbac1690731032438fa2a
openoffice.org-i18n-1.1.2-24.2.0.EL3.i386.rpm 2e5336c39975c611ffa23145d9985dbb
openoffice.org-libs-1.1.2-24.2.0.EL3.i386.rpm afa55ff288e8fa052fada08cc0a56235
Red Hat Enterprise Linux ES (v. 4)
--------------------------------------------------------------------------------
SRPMS:
openoffice.org-1.1.2-24.6.0.EL4.src.rpm 782df44227035bdae27f4d5b82548244
IA-32:
openoffice.org-1.1.2-24.6.0.EL4.i386.rpm 700fc3a6036a9206f31bd7d9ac7db80c
openoffice.org-i18n-1.1.2-24.6.0.EL4.i386.rpm 9dc5d0f31383ea144f216c7bfe18efa2
openoffice.org-kde-1.1.2-24.6.0.EL4.i386.rpm 93e50067e6aa036fb4356846b61d730e
openoffice.org-libs-1.1.2-24.6.0.EL4.i386.rpm fb4760c12f39bdea783d35ddecdf7ff7
x86_64:
openoffice.org-1.1.2-24.6.0.EL4.i386.rpm 700fc3a6036a9206f31bd7d9ac7db80c
openoffice.org-i18n-1.1.2-24.6.0.EL4.i386.rpm 9dc5d0f31383ea144f216c7bfe18efa2
openoffice.org-libs-1.1.2-24.6.0.EL4.i386.rpm fb4760c12f39bdea783d35ddecdf7ff7
Red Hat Enterprise Linux WS (v. 3)
--------------------------------------------------------------------------------
SRPMS:
openoffice.org-1.1.2-24.2.0.EL3.src.rpm 28b62078a887294f683d0ef33c4fb7d8
IA-32:
openoffice.org-1.1.2-24.2.0.EL3.i386.rpm 3fb7f2cc17fdbac1690731032438fa2a
openoffice.org-i18n-1.1.2-24.2.0.EL3.i386.rpm 2e5336c39975c611ffa23145d9985dbb
openoffice.org-libs-1.1.2-24.2.0.EL3.i386.rpm afa55ff288e8fa052fada08cc0a56235
x86_64:
openoffice.org-1.1.2-24.2.0.EL3.i386.rpm 3fb7f2cc17fdbac1690731032438fa2a
openoffice.org-i18n-1.1.2-24.2.0.EL3.i386.rpm 2e5336c39975c611ffa23145d9985dbb
openoffice.org-libs-1.1.2-24.2.0.EL3.i386.rpm afa55ff288e8fa052fada08cc0a56235
Red Hat Enterprise Linux WS (v. 4)
--------------------------------------------------------------------------------
SRPMS:
openoffice.org-1.1.2-24.6.0.EL4.src.rpm 782df44227035bdae27f4d5b82548244
IA-32:
openoffice.org-1.1.2-24.6.0.EL4.i386.rpm 700fc3a6036a9206f31bd7d9ac7db80c
openoffice.org-i18n-1.1.2-24.6.0.EL4.i386.rpm 9dc5d0f31383ea144f216c7bfe18efa2
openoffice.org-kde-1.1.2-24.6.0.EL4.i386.rpm 93e50067e6aa036fb4356846b61d730e
openoffice.org-libs-1.1.2-24.6.0.EL4.i386.rpm fb4760c12f39bdea783d35ddecdf7ff7
x86_64:
openoffice.org-1.1.2-24.6.0.EL4.i386.rpm 700fc3a6036a9206f31bd7d9ac7db80c
openoffice.org-i18n-1.1.2-24.6.0.EL4.i386.rpm 9dc5d0f31383ea144f216c7bfe18efa2
openoffice.org-libs-1.1.2-24.6.0.EL4.i386.rpm fb4760c12f39bdea783d35ddecdf7ff7
(The unlinked packages above are only available from the Red Hat Network)
Bugs fixed (see bugzilla for more information)
154540 - CAN-2005-0941 openoffice.org heap overflow
References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0941
http://www.openoffice.org/issues/show_bug.cgi?id=46388
--------------------------------------------------------------------------------
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package
The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/
|
|
