OpenOffice Insecure Document Signing Weakness

Bugtraq ID:	26859
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 13 2007 12:00AM
Updated:	Dec 14 2007 05:02PM
Credit:	Henrich C. Poehls, Dong Tran, Finn Petersen, and Frederic Pscheid from the Department of Informatics at the University of Hamburg are credited with the discovery of this issue.
Vulnerable:	OpenOffice OpenOffice 2.3 OpenOffice OpenOffice 2.2
Not Vulnerable:

OpenOffice Insecure Document Signing Weakness

OpenOffice fails to securely sign XML-based OpenDocument Format (ODF) files.

Attackers can leverage this weakness to manipulate signed documents that contain malicious data in such a way that the signature remains intact.

This weakness results in a false sense of security and could help an attacker exploit latent vulnerabilities.

OpenOffice 2.3.0 and 2.2.0 are vulnerable; other versions may also be affected.

OpenOffice Insecure Document Signing Weakness

An attacker can exploit this issue using readily available text-editing utilities.

OpenOffice Insecure Document Signing Weakness

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

OpenOffice Insecure Document Signing Weakness

References:

• OpenOffice Homepage (OpenOffice)
  
• OpenOffice: Duplicated, Unprotected Certificate Information shown ([email protected])