OpenOffice RTF File Parser Buffer Overflow Vulnerability
BID:24450
Info
OpenOffice RTF File Parser Buffer Overflow Vulnerability
| Bugtraq ID: | 24450 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2007-0245 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 12 2007 12:00AM |
| Updated: | Mar 19 2015 08:24AM |
| Credit: | John Heasman is credited with the discovery of this vulnerability. |
| Vulnerable: |
Ubuntu Ubuntu Linux 7.04 sparc Ubuntu Ubuntu Linux 7.04 powerpc Ubuntu Ubuntu Linux 7.04 i386 Ubuntu Ubuntu Linux 7.04 amd64 Ubuntu Ubuntu Linux 6.10 sparc Ubuntu Ubuntu Linux 6.10 powerpc Ubuntu Ubuntu Linux 6.10 i386 Ubuntu Ubuntu Linux 6.10 amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 SuSE SUSE Linux Enterprise SDK 10 SuSE SUSE Linux Enterprise Desktop 10 SuSE Linux Desktop 1.0 Sun StarSuite 8 Update 7 Sun StarSuite 8 Update 6 Sun StarSuite 8 Sun StarSuite 7 PP9 Sun StarSuite 7 Sun StarSuite 6 PP6 Sun StarSuite 6 Sun StarOffice 7.0 Sun StarOffice 8.0 Sun StarOffice 8 Update 7 Sun StarOffice 8 Update 6 Sun StarOffice 7.0 PP9 Sun StarOffice 6.0 PP6 Sun StarOffice 6.0 SGI ProPack 3.0 SP6 S.u.S.E. openSUSE 10.2 S.u.S.E. Linux 10.1 rPath rPath Linux 1 RedHat Enterprise Linux WS 4 RedHat Enterprise Linux WS 3 RedHat Enterprise Linux Optional Productivity Application 5 server RedHat Enterprise Linux ES 4 RedHat Enterprise Linux ES 3 RedHat Desktop 4.0 RedHat Desktop 3.0 Red Hat Fedora Core6 Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux AS 4 Red Hat Enterprise Linux AS 3 OpenOffice OpenOffice 2.0.4 OpenOffice OpenOffice 2.0.3 -1 OpenOffice OpenOffice 2.0.3 OpenOffice OpenOffice 2.0.2 OpenOffice OpenOffice 2.0.1 OpenOffice OpenOffice 2.0 Beta OpenOffice OpenOffice 2.2 OpenOffice OpenOffice 2.1 Novell Linux Desktop 9 Mandriva Linux Mandrake 2007.1 x86_64 Mandriva Linux Mandrake 2007.1 Mandriva Linux Mandrake 2007.0 x86_64 Mandriva Linux Mandrake 2007.0 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 Gentoo Linux Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 Avaya Interactive Response 2.0 |
| Not Vulnerable: |
OpenOffice OpenOffice 2.2.1 |
Discussion
OpenOffice RTF File Parser Buffer Overflow Vulnerability
OpenOffice is prone to a remote heap-based buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.
Remote attackers may exploit this issue by enticing victims into opening maliciously crafted RTF files.
An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial of service.
OpenOffice is prone to a remote heap-based buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.
Remote attackers may exploit this issue by enticing victims into opening maliciously crafted RTF files.
An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial of service.
Exploit / POC
OpenOffice RTF File Parser Buffer Overflow Vulnerability
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
Solution / Fix
OpenOffice RTF File Parser Buffer Overflow Vulnerability
Solution:
Please see the referenced advisories for details on obtaining the appropriate updates.
Sun StarSuite 6 PP6
Sun StarSuite 8 Update 7
Sun StarOffice 8 Update 7
OpenOffice OpenOffice 2.2
Sun StarSuite 7 PP9
OpenOffice OpenOffice 2.1
Sun StarSuite 7
Sun StarOffice 7.0 PP9
Sun StarOffice 6.0
OpenOffice OpenOffice 2.0 Beta
OpenOffice OpenOffice 2.0.1
OpenOffice OpenOffice 2.0.2
OpenOffice OpenOffice 2.0.3
OpenOffice OpenOffice 2.0.3 -1
OpenOffice OpenOffice 2.0.4
SGI ProPack 3.0 SP6
Solution:
Please see the referenced advisories for details on obtaining the appropriate updates.
Sun StarSuite 6 PP6
-
Sun 112886-08
x86 Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -112886-08-1 -
Sun 112887-08
Linux Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -112887-08-1
Sun StarSuite 8 Update 7
-
Sun 120188-10
Linux Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -120188-10-1 -
Sun 120189-11
Sparc Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -120189-11-1 -
Sun 120190-11
x86 Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -120190-11-1 -
Sun 120191-10
Windows Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -120191-10-1
Sun StarOffice 8 Update 7
-
Sun 120184-10
Linux Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -120184-10-1 -
Sun 120185-11
Sparc Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -120185-11-1 -
Sun 120186-11
x86Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -120186-11-1 -
Sun 120187-10
Windows Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -120187-10-1
OpenOffice OpenOffice 2.2
-
OpenOffice OpenOffice 2.2.1
http://download.openoffice.org/2.2.1/index.html
Sun StarSuite 7 PP9
-
Sun 116519-14
Sparc Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -116519-14-1
OpenOffice OpenOffice 2.1
-
OpenOffice OpenOffice 2.2.1
http://download.openoffice.org/2.2.1/index.html
Sun StarSuite 7
-
Sun 116518-14
Linux Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -116518-14-1 -
Sun 116529-13
Windows Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -116520-13-1 -
Sun 117073-12
x86 Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -117073-12-1
Sun StarOffice 7.0 PP9
-
Sun 116518-14
Linux Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -116518-14-1 -
Sun 116519-14
Sparc Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -116519-14-1 -
Sun 116529-13
Windows Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -116520-13-1 -
Sun 117073-12
x86 Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -117073-12-1
Sun StarOffice 6.0
-
Sun 112886-08
x86 Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -112886-08-1 -
Sun 112887-08
Linux Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -112887-08-1 -
Sun 112888-08
Windows Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -112888-08-1
OpenOffice OpenOffice 2.0 Beta
-
OpenOffice OpenOffice 2.2.1
http://download.openoffice.org/2.2.1/index.html
OpenOffice OpenOffice 2.0.1
-
OpenOffice OpenOffice 2.2.1
http://download.openoffice.org/2.2.1/index.html
OpenOffice OpenOffice 2.0.2
-
OpenOffice OpenOffice 2.2.1
http://download.openoffice.org/2.2.1/index.html
OpenOffice OpenOffice 2.0.3
-
OpenOffice OpenOffice 2.2.1
http://download.openoffice.org/2.2.1/index.html
OpenOffice OpenOffice 2.0.3 -1
-
OpenOffice OpenOffice 2.2.1
http://download.openoffice.org/2.2.1/index.html
OpenOffice OpenOffice 2.0.4
-
OpenOffice OpenOffice 2.2.1
http://download.openoffice.org/2.2.1/index.html
SGI ProPack 3.0 SP6
-
SGI Patch 10421
ftp://oss.sgi.com/projects/sgi_propack/download/
References
OpenOffice RTF File Parser Buffer Overflow Vulnerability
References:
References:
- OpenOffice Homepage (OpenOffice)
- OpenOffice.org 2.2.1 (build OOF680_m18) - Release Notes (OpenOffice)
- rpms/openoffice.org/FC-6 openoffice.org-2.2.1.ooo77214.rtfprtdata.sw.patch, NONE (Red Hat)
- USN-482-1: OpenOffice.org vulnerability (Ubuntu)
- High risk vulnerability in OpenOffice RTF parser (NGSSoftware Insight Security Research)
- ASA-2007-278 Security Vulnerability with Manipulated RTF Files May Lead to Heap (Avaya)
- RHSA-2007:0406-5 openoffice.org security update (Red Hat)
- Sun Alert ID: 102917 Security Vulnerability with Manipulated RTF Files May Lead (Sun)