Executive Summary

Summary
Title New OpenOffice.org packages fix several vulnerabilities
Informations
Name DSA-1270 First vendor Publication 2007-03-20
Vendor Debian Last vendor Modification 2007-03-28
Severity (Vendor) N/A Revision 2

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score 9.3 Attack Range Network
Cvss Impact Score 10 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Several security related problems have been discovered in OpenOffice.org, the free office suite. The Common Vulnerabilities and Exposures project identifies the following problems:

CVE-2007-0002

iDefense reported several integer overflow bugs in libwpd, a library for handling WordPerfect documents that is included in OpenOffice.org. Attackers are able to exploit these with carefully crafted WordPerfect files that could cause an application linked with libwpd to crash or possibly execute arbitrary code.

CVE-2007-0238

Next Generation Security discovered that the StarCalc parser in OpenOffice.org contains an easily exploitable stack overflow that could be used exploited by a specially crafted document to execute arbitrary code.

CVE-2007-0239

It has been reported that OpenOffice.org does not escape shell meta characters and is hence vulnerable to execute arbitrary shell commands via a specially crafted document after the user clicked to a prepared link.

This updated advisory only provides packages for the upcoming etch release alias Debian GNU/Linux 4.0.

For the stable distribution (sarge) these problems have been fixed in version 1.1.3-9sarge6.

For the testing distribution (etch) these problems have been fixed in version 2.0.4.dfsg.2-5etch1.

For the unstable distribution (sid) these problems have been fixed in version 2.0.4.dfsg.2-6.

We recommend that you upgrade your OpenOffice.org packages.

Original Source

Url : http://www.debian.org/security/2007/dsa-1270

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:11422
 
Oval ID: oval:org.mitre.oval:def:11422
Title: OpenOffice.org (OOo) Office Suite allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a prepared link in a crafted document.
Description: OpenOffice.org (OOo) Office Suite allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a prepared link in a crafted document.
Family: unix Class: vulnerability
Reference(s): CVE-2007-0239
 Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11535
 
Oval ID: oval:org.mitre.oval:def:11535
Title: Multiple heap-based buffer overflows in WordPerfect Document importer/exporter (libwpd) before 0.8.9 allow user-assisted remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted WordPerfect file in which values to loop counters are not properly handled in the (1) WP3TablesGroup::_readContents and (2) WP5DefinitionGroup_DefineTablesSubGroup::WP5DefinitionGroup_DefineTablesSubGroup functions. NOTE: the integer overflow has been split into CVE-2007-1466.
Description: Multiple heap-based buffer overflows in WordPerfect Document importer/exporter (libwpd) before 0.8.9 allow user-assisted remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted WordPerfect file in which values to loop counters are not properly handled in the (1) WP3TablesGroup::_readContents and (2) WP5DefinitionGroup_DefineTablesSubGroup::WP5DefinitionGroup_DefineTablesSubGroup functions. NOTE: the integer overflow has been split into CVE-2007-1466.
Family: unix Class: vulnerability
Reference(s): CVE-2007-0002
 Version: 5
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:18862
 
Oval ID: oval:org.mitre.oval:def:18862
Title: DSA-1268-1 libwpd - integer overflow
Description: iDefense reported several integer overflow bugs in libwpd, a library for handling WordPerfect documents. Attackers were able to exploit these with carefully crafted Word Perfect files that could cause an application linked with libwpd to crash or possibly execute arbitrary code.
Family: unix Class: patch
Reference(s): DSA-1268-1
CVE-2007-0002
 Version: 7
Platform(s): Debian GNU/Linux 4.0
 Product(s): libwpd
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22523
 
Oval ID: oval:org.mitre.oval:def:22523
Title: ELSA-2007:0069: openoffice.org security update (Important)
Description: OpenOffice.org (OOo) Office Suite allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a prepared link in a crafted document.
Family: unix Class: patch
Reference(s): ELSA-2007:0069-01
CVE-2007-0238
CVE-2007-0239
 Version: 13
Platform(s): Oracle Linux 5
 Product(s): openoffice.org
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:8968
 
Oval ID: oval:org.mitre.oval:def:8968
Title: Stack-based buffer overflow in filter\starcalc\scflt.cxx in the StarCalc parser in OpenOffice.org (OOo) Office Suite before 2.2, and 1.x before 1.1.5 Patch, allows user-assisted remote attackers to execute arbitrary code via a document with a long Note.
Description: Stack-based buffer overflow in filter\starcalc\scflt.cxx in the StarCalc parser in OpenOffice.org (OOo) Office Suite before 2.2, and 1.x before 1.1.5 Patch, allows user-assisted remote attackers to execute arbitrary code via a document with a long Note.
Family: unix Class: vulnerability
Reference(s): CVE-2007-0238
 Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
 Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 3
Application 1

OpenVAS Exploits

Date Description
2009-04-09 Name : Mandriva Update for libwpd MDKSA-2007:063 (libwpd)
File : nvt/gb_mandriva_MDKSA_2007_063.nasl
2009-04-09 Name : Mandriva Update for openoffice.org MDKSA-2007:064 (openoffice.org)
File : nvt/gb_mandriva_MDKSA_2007_064.nasl
2009-04-09 Name : Mandriva Update for openoffice.org MDKSA-2007:073 (openoffice.org)
File : nvt/gb_mandriva_MDKSA_2007_073.nasl
2009-03-23 Name : Ubuntu Update for libwpd vulnerability USN-437-1
File : nvt/gb_ubuntu_USN_437_1.nasl
2009-03-23 Name : Ubuntu Update for openoffice.org(2)/-amd64, ia32-libs-openoffice.org vulnera...
File : nvt/gb_ubuntu_USN_444_1.nasl
2009-02-27 Name : Fedora Update for libwpd FEDORA-2007-350
File : nvt/gb_fedora_2007_350_libwpd_fc5.nasl
2009-02-27 Name : Fedora Update for libwpd FEDORA-2007-351
File : nvt/gb_fedora_2007_351_libwpd_fc6.nasl
2009-02-27 Name : Fedora Update for openoffice.org FEDORA-2007-375
File : nvt/gb_fedora_2007_375_openoffice.org_fc5.nasl
2009-02-27 Name : Fedora Update for openoffice.org FEDORA-2007-376
File : nvt/gb_fedora_2007_376_openoffice.org_fc6.nasl
2009-02-27 Name : Fedora Update for openoffice.org FEDORA-2007-606
File : nvt/gb_fedora_2007_606_openoffice.org_fc5.nasl
2009-01-28 Name : SuSE Update for OpenOffice_org,libwpd SUSE-SA:2007:023
File : nvt/gb_suse_2007_023.nasl
2008-09-24 Name : Gentoo Security Advisory GLSA 200704-07 (libwpd)
File : nvt/glsa_200704_07.nasl
2008-09-24 Name : Gentoo Security Advisory GLSA 200704-12 (OpenOffice.org)
File : nvt/glsa_200704_12.nasl
2008-01-17 Name : Debian Security Advisory DSA 1268-1 (libwpd)
File : nvt/deb_1268_1.nasl
2008-01-17 Name : Debian Security Advisory DSA 1270-1 (openoffice.org)
File : nvt/deb_1270_1.nasl
2008-01-17 Name : Debian Security Advisory DSA 1270-2 (openoffice.org)
File : nvt/deb_1270_2.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
33972 OpenOffice.org (OOo) StarCalc Parser Crafted Document Parsing Overflow
33971 OpenOffice.org (OOo) Crafted Link Shell Metacharacter Arbitrary Command Execu...
33315 WordPerfect Document importer/exporter (libwpd) Crafted File Handling Multipl...

Snort® IPS/IDS

Date Description
2014-01-10 WordPerfect WP3TablesGroup heap overflow attempt
RuleID : 21437 - Revision : 6 - Type : FILE-OTHER

Nessus® Vulnerability Scanner

Date Description
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2007-0033.nasl - Type : ACT_GATHER_INFO
2013-01-24 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2007-0069.nasl - Type : ACT_GATHER_INFO
2007-12-13 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_OpenOffice_org-2651.nasl - Type : ACT_GATHER_INFO
2007-11-10 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-444-1.nasl - Type : ACT_GATHER_INFO
2007-11-10 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-437-1.nasl - Type : ACT_GATHER_INFO
2007-10-17 Name : The remote openSUSE host is missing a security update.
File : suse_libwpd-3038.nasl - Type : ACT_GATHER_INFO
2007-10-17 Name : The remote openSUSE host is missing a security update.
File : suse_libwpd-2642.nasl - Type : ACT_GATHER_INFO
2007-10-17 Name : The remote openSUSE host is missing a security update.
File : suse_OpenOffice_org-2682.nasl - Type : ACT_GATHER_INFO
2007-10-17 Name : The remote openSUSE host is missing a security update.
File : suse_OpenOffice_org-2652.nasl - Type : ACT_GATHER_INFO
2007-05-25 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2007-0055.nasl - Type : ACT_GATHER_INFO
2007-04-19 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200704-12.nasl - Type : ACT_GATHER_INFO
2007-04-10 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200704-07.nasl - Type : ACT_GATHER_INFO
2007-04-06 Name : The remote Windows host has a program that may be affected by multiple vulner...
File : openoffice_220.nasl - Type : ACT_GATHER_INFO
2007-04-05 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2007-073.nasl - Type : ACT_GATHER_INFO
2007-04-05 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2007-085-02.nasl - Type : ACT_GATHER_INFO
2007-04-05 Name : The remote Fedora Core host is missing a security update.
File : fedora_2007-376.nasl - Type : ACT_GATHER_INFO
2007-04-05 Name : The remote Fedora Core host is missing a security update.
File : fedora_2007-375.nasl - Type : ACT_GATHER_INFO
2007-03-26 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2007-0033.nasl - Type : ACT_GATHER_INFO
2007-03-26 Name : The remote Fedora Core host is missing a security update.
File : fedora_2007-351.nasl - Type : ACT_GATHER_INFO
2007-03-26 Name : The remote Fedora Core host is missing a security update.
File : fedora_2007-350.nasl - Type : ACT_GATHER_INFO
2007-03-26 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1270.nasl - Type : ACT_GATHER_INFO
2007-03-26 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2007-0033.nasl - Type : ACT_GATHER_INFO
2007-03-18 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2007-064.nasl - Type : ACT_GATHER_INFO
2007-03-18 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2007-063.nasl - Type : ACT_GATHER_INFO
2007-03-18 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1268.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:26:33
  • Multiple Updates