SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Apache OpenOffice Vendors:   OpenOffice.org
OpenOffice.org Office Suite Bugs Let Remote Users Execute Arbitrary Code or Shell Commands
SecurityTracker Alert ID:  1017799
SecurityTracker URL:  http://securitytracker.com/id/1017799
CVE Reference:   CVE-2007-0238, CVE-2007-0239   (Links to External Site)
Updated:  Mar 28 2007
Original Entry Date:  Mar 20 2007
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to 2.2
Description:   A vulnerability was reported in OpenOffice.org Office Suite. A remote user can cause arbitrary code to be executed on the target user's system.

A remote user can create a specially crafted document that, when loaded by the target user, will trigger a stack overflow in the StarCalc parser and execute arbitrary code on the target system [CVE-2007-0238]. The code will run with the privileges of the target user.

Next Generation Security discovered this vulnerability.

A remote user can create a specially crafted URI that, when loaded by the target user, will execute arbitrary shell commands on the target system [CVE-2007-0239]. The code will run with the privileges of the target user.

Impact:   A remote user can create a document that, when loaded by the target user, will execute arbitrary code on the target user's system.
Solution:   The vendor has issued a fix (2.2). Also, a patch is available for version 1.1.5.

The vendor's advisories are available at:

http://www.openoffice.org/security/CVE-2007-0238
http://www.openoffice.org/security/CVE-2007-0239

Vendor URL:  www.openoffice.org/security/CVE-2007-0238 (Links to External Site)
Cause:   Boundary error, Input validation error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Mar 22 2007 (Red Hat Issues Fix) OpenOffice.org Office Suite Bugs Let Remote Users Execute Arbitrary Code or Shell Commands
Red Hat has issued a fix for Red Hat Enterprise Linux 3 and 4.
Mar 22 2007 (Red Hat Issues Fix) OpenOffice.org Office Suite Bugs Let Remote Users Execute Arbitrary Code or Shell Commands
Red Hat has released a fix for Red Hat Enterprise Linux 5.
Mar 27 2007 (Sun Issues Fix for StarOffice) OpenOffice.org Office Suite Bugs Let Remote Users Execute Arbitrary Code or Shell Commands
Sun has issued a fix for Sun StarOffice for the StarCalc vulnerability.
Mar 27 2007 (Sun Issues Advisory for StarOffice) OpenOffice.org Office Suite Bugs Let Remote Users Execute Arbitrary Code or Shell Commands
Sun has issued an advisory for Sun StarOffice for the URI vulnerability.



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC