OpenOffice '.doc' File Remote Denial of Service Vulnerability

Bugtraq ID:	33383
Class:	Unknown
CVE:	CVE-2009-0259
Remote:	Yes
Local:	No
Published:	Jan 21 2009 12:00AM
Updated:	Jan 29 2009 08:59PM
Credit:	Jan Iankko Lieskovsky
Vulnerable:	OpenOffice OpenOffice 1.1.5 OpenOffice OpenOffice 1.1.4 + Gentoo Linux OpenOffice OpenOffice 1.1.3 -9sarge3 + Gentoo Linux + Redhat Fedora Core3 + Ubuntu Ubuntu Linux 5.0 4 powerpc + Ubuntu Ubuntu Linux 5.0 4 i386 + Ubuntu Ubuntu Linux 5.0 4 amd64 OpenOffice OpenOffice 1.1.3 + Gentoo Linux + Redhat Fedora Core3 + Ubuntu Ubuntu Linux 5.0 4 powerpc + Ubuntu Ubuntu Linux 5.0 4 i386 + Ubuntu Ubuntu Linux 5.0 4 amd64 OpenOffice OpenOffice 1.1.2 + Ubuntu Ubuntu Linux 4.1 ppc + Ubuntu Ubuntu Linux 4.1 ia64 + Ubuntu Ubuntu Linux 4.1 ia32 OpenOffice OpenOffice 1.1.2-38.2.0.EL3
Not Vulnerable:	OpenOffice OpenOffice 1.1.5-10.6.0.5.EL4

OpenOffice '.doc' File Remote Denial of Service Vulnerability

OpenOffice is prone to a remote denial-of-service vulnerability.

Attackers can exploit this issue by enticing an unsuspecting victim to open a specially crafted '.doc' file.

Successfully exploiting this issue will cause the application to crash, denying service to legitimate users. Attackers may also be able to run arbitrary code, but this has not been confirmed.

OpenOffice '.doc' File Remote Denial of Service Vulnerability

The following example '.doc' file is available:

• /data/vulnerabilities/exploits/2008-crash.doc.rar

OpenOffice '.doc' File Remote Denial of Service Vulnerability

Solution:
Reports indicate that this issue has been fixed. Please see the references for more information.

OpenOffice '.doc' File Remote Denial of Service Vulnerability

References:

• CVE Request -- openoffice.org (CVE-2008-4841) (Jan iankko Lieskovsk)
  
• OpenOffice Homepage (OpenOffice)