Executive Summary
Summary | |
---|---|
Title | openoffice.org security update |
Informations | |||
---|---|---|---|
Name | RHSA-2009:1426 | First vendor Publication | 2009-09-04 |
Vendor | RedHat | Last vendor Modification | 2009-09-04 |
Severity (Vendor) | Important | Revision | 01 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 9.3 | Attack Range | Network |
Cvss Impact Score | 10 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Problem Description: Updated openoffice.org packages that correct security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 3 - i386, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, x86_64 Red Hat Enterprise Linux WS version 3 - i386, x86_64 Red Hat Enterprise Linux AS version 4 - i386, ppc, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, x86_64 Red Hat Enterprise Linux WS version 4 - i386, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 RHEL Optional Productivity Applications (v. 5 server) - i386, x86_64 3. Description: OpenOffice.org is an office productivity suite that includes desktop applications, such as a word processor, spreadsheet, presentation manager, formula editor, and a drawing program. An integer underflow flaw and a boundary error flaw, both possibly leading to a heap-based buffer overflow, were found in the way OpenOffice.org parses certain records in Microsoft Word documents. An attacker could create a specially-crafted Microsoft Word document, which once opened by an unsuspecting user, could cause OpenOffice.org to crash or, potentially, execute arbitrary code with the permissions of the user running OpenOffice.org. (CVE-2009-0200, CVE-2009-0201) All users of OpenOffice.org are advised to upgrade to these updated packages, which contain backported patches to correct these issues. All running instances of OpenOffice.org applications must be restarted for this update to take effect. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 500993 - CVE-2009-0200 OpenOffice.org Word document Integer Underflow 502194 - CVE-2009-0201 OpenOffice.org Word document buffer overflow |
Original Source
Url : https://rhn.redhat.com/errata/RHSA-2009-1426.html |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
50 % | CWE-189 | Numeric Errors (CWE/SANS Top 25) |
50 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
CPE : Common Platform Enumeration
OpenVAS Exploits
Date | Description |
---|---|
2011-08-09 | Name : CentOS Update for openoffice.org CESA-2009:1426 centos3 i386 File : nvt/gb_CESA-2009_1426_openoffice.org_centos3_i386.nasl |
2011-08-09 | Name : CentOS Update for openoffice.org CESA-2009:1426 centos4 i386 File : nvt/gb_CESA-2009_1426_openoffice.org_centos4_i386.nasl |
2010-05-28 | Name : Mandriva Update for openoffice.org MDVSA-2010:105 (openoffice.org) File : nvt/gb_mandriva_MDVSA_2010_105.nasl |
2010-05-07 | Name : Mandriva Update for openoffice.org MDVSA-2010:091 (openoffice.org) File : nvt/gb_mandriva_MDVSA_2010_091.nasl |
2010-03-22 | Name : Mandriva Update for lvm2 MDVA-2010:105 (lvm2) File : nvt/gb_mandriva_MDVA_2010_105.nasl |
2010-03-12 | Name : Mandriva Update for slib MDVA-2010:091 (slib) File : nvt/gb_mandriva_MDVA_2010_091.nasl |
2010-03-12 | Name : Mandriva Update for openoffice.org MDVSA-2010:056 (openoffice.org) File : nvt/gb_mandriva_MDVSA_2010_056.nasl |
2010-02-15 | Name : Mandriva Update for samba MDVA-2010:056 (samba) File : nvt/gb_mandriva_MDVA_2010_056.nasl |
2010-02-15 | Name : Mandriva Update for openoffice.org MDVSA-2010:035 (openoffice.org) File : nvt/gb_mandriva_MDVSA_2010_035.nasl |
2009-09-21 | Name : SuSE Security Summary SUSE-SR:2009:015 File : nvt/suse_sr_2009_015.nasl |
2009-09-09 | Name : RedHat Security Advisory RHSA-2009:1426 File : nvt/RHSA_2009_1426.nasl |
2009-09-09 | Name : Fedora Core 10 FEDORA-2009-9256 (openoffice.org) File : nvt/fcore_2009_9256.nasl |
2009-09-09 | Name : CentOS Security Advisory CESA-2009:1426 (openoffice.org) File : nvt/ovcesa2009_1426.nasl |
2009-09-08 | Name : OpenOffice.org Word Documents Parsing Buffer Overflow Vulnerability (Linux) File : nvt/gb_openoffice_word_bof_vuln_lin.nasl |
2009-09-08 | Name : OpenOffice.org Word Documents Parsing Buffer Overflow Vulnerability (Win) File : nvt/gb_openoffice_word_bof_vuln_win.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
58211 | StarOffice / StarSuite Word Document Table Parsing Heap Overflow |
58210 | StarOffice / StarSuite Word Document Table Parsing Buffer Overflow |
57659 | OpenOffice.org (OOo) Word Document Table Parsing Heap Overflow |
57658 | OpenOffice.org (OOo) Word Document Table Parsing Buffer Overflow |
Snort® IPS/IDS
Date | Description |
---|---|
2015-07-22 | OpenOffice Word document table parsing sprmTDelete heap buffer overflow attempt RuleID : 34925 - Revision : 2 - Type : FILE-OFFICE |
2015-07-22 | OpenOffice Word document table parsing sprmTDelete heap buffer overflow attempt RuleID : 34924 - Revision : 2 - Type : FILE-OFFICE |
2014-01-10 | OpenOffice Word document table parsing heap buffer overflow attempt RuleID : 17665 - Revision : 8 - Type : FILE-OFFICE |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2014-09-01 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201408-19.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-1426.nasl - Type : ACT_GATHER_INFO |
2013-01-24 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1426.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20090904_openoffice_org_on_SL3_x.nasl - Type : ACT_GATHER_INFO |
2011-01-27 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_OpenOffice_org-6469.nasl - Type : ACT_GATHER_INFO |
2011-01-21 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_OpenOffice_org-090828.nasl - Type : ACT_GATHER_INFO |
2010-07-30 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2010-035.nasl - Type : ACT_GATHER_INFO |
2010-05-24 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2010-105.nasl - Type : ACT_GATHER_INFO |
2010-03-08 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2010-056.nasl - Type : ACT_GATHER_INFO |
2010-02-24 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1880.nasl - Type : ACT_GATHER_INFO |
2009-10-06 | Name : The remote openSUSE host is missing a security update. File : suse_OpenOffice_org-6421.nasl - Type : ACT_GATHER_INFO |
2009-10-02 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-840-1.nasl - Type : ACT_GATHER_INFO |
2009-09-24 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_OpenOffice_org-090829.nasl - Type : ACT_GATHER_INFO |
2009-09-08 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-1426.nasl - Type : ACT_GATHER_INFO |
2009-09-08 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_OpenOffice_org-090810.nasl - Type : ACT_GATHER_INFO |
2009-09-08 | Name : The remote openSUSE host is missing a security update. File : suse_11_1_OpenOffice_org-math-090810.nasl - Type : ACT_GATHER_INFO |
2009-09-04 | Name : The remote Fedora host is missing a security update. File : fedora_2009-9256.nasl - Type : ACT_GATHER_INFO |
2009-09-01 | Name : The remote Windows host has a program affected by multiple buffer overflows. File : openoffice_311.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:52:51 |
|