OpenOffice '.csv' File Remote Denial of Service Vulnerability

Bugtraq ID:	37807
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 14 2010 12:00AM
Updated:	Jan 14 2010 12:00AM
Credit:	Hellcode Research
Vulnerable:	OpenOffice OpenOffice 3.1.1 OpenOffice OpenOffice 3.1
Not Vulnerable:

OpenOffice '.csv' File Remote Denial of Service Vulnerability

OpenOffice is prone to a remote denial-of-service vulnerability.

Attackers can exploit this issue by enticing an unsuspecting victim to open a specially crafted '.csv' file.

Successful exploits will cause the application to crash, denying service to legitimate users. Given the nature of this issue, attackers may also be able to run arbitrary code, but this has not been confirmed.

OpenOffice 3.1.0 and 3.1.1 on Microsoft Windows are affected.

OpenOffice '.csv' File Remote Denial of Service Vulnerability

The following example '.csv' file is available:

• /data/vulnerabilities/exploits/csv.rar

OpenOffice '.csv' File Remote Denial of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

OpenOffice '.csv' File Remote Denial of Service Vulnerability

References:

• OpenOffice Homepage (OpenOffice)
  
• Hellcode Research: OpenOffice File Parsing Null Pointer Vulnerability ([email protected])