OpenOffice RTF File Parser Buffer Overflow Vulnerability

TITLE: OpenOffice RTF File Parser Buffer Overflow Vulnerability
CLASS: Boundary Condition Error
CVE: CVE-2007-0245

REMOTE: Yes
LOCAL: No
PUBLISHED: Jun 12 2007 12:00AM
UPDATE: Jun 15 2007 08:19PM
CREDIT: John Heasman is credited with the discovery of this vulnerability.
VULNERABLE:

Sun StarSuite 8 Update 7
Sun StarSuite 8 Update 6
Sun StarSuite 8
Sun StarSuite 7 PP9
Sun StarSuite 7
Sun StarSuite 6 PP6
Sun StarSuite 6
Sun StarOffice 7.0
Sun StarOffice 8.0
Sun StarOffice 8 Update 7
Sun StarOffice 8 Update 6
Sun StarOffice 7.0 PP9
Sun StarOffice 6.0 PP6
Sun StarOffice 6.0
RedHat Fedora Core6
RedHat Enterprise Linux Optional Productivity Application v.5 server
RedHat Enterprise Linux Desktop v.5 client
RedHat Enterprise Linux WS 4
RedHat Enterprise Linux WS 3
RedHat Enterprise Linux ES 4
RedHat Enterprise Linux ES 3
RedHat Enterprise Linux AS 4
RedHat Enterprise Linux AS 3
RedHat Desktop 4.0
RedHat Desktop 3.0
OpenOffice OpenOffice 2.0.4
OpenOffice OpenOffice 2.0.3 -1
OpenOffice OpenOffice 2.0.3
OpenOffice OpenOffice 2.0.2
OpenOffice OpenOffice 2.0.1
OpenOffice OpenOffice 2.0 Beta
OpenOffice OpenOffice 2.2
OpenOffice OpenOffice 2.1
Debian Linux 3.1 sparc
Debian Linux 3.1 s/390
Debian Linux 3.1 ppc
Debian Linux 3.1 mipsel
Debian Linux 3.1 mips
Debian Linux 3.1 m68k
Debian Linux 3.1 ia-64
Debian Linux 3.1 ia-32
Debian Linux 3.1 hppa
Debian Linux 3.1 arm
Debian Linux 3.1 amd64
Debian Linux 3.1 alpha
Debian Linux 3.1
Debian Linux 4.0 sparc
Debian Linux 4.0 s/390
Debian Linux 4.0 powerpc
Debian Linux 4.0 mipsel
Debian Linux 4.0 mips
Debian Linux 4.0 m68k
Debian Linux 4.0 ia-64
Debian Linux 4.0 ia-32
Debian Linux 4.0 hppa
Debian Linux 4.0 arm
Debian Linux 4.0 amd64
Debian Linux 4.0 alpha
Debian Linux 4.0
NOT VULNERABLE:
OpenOffice OpenOffice 2.2.1

Vai alla pagina originale su Security Focus

Discussion

OpenOffice is prone to a remote heap-based buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

Remote attackers may exploit this issue by enticing victims into opening maliciously crafted RTF files.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial of service.

Exploit

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:vuldb@securityfocus.com.

Solution

Solution:
Please see the referenced advisories for details on obtaining the appropriate updates.


Sun StarSuite 8 Update 7


Sun StarOffice 7.0 PP9

Sun StarOffice 8 Update 7

OpenOffice OpenOffice 2.2

Sun StarOffice 6.0

OpenOffice OpenOffice 2.1

Sun StarSuite 7

OpenOffice OpenOffice 2.0 Beta

OpenOffice OpenOffice 2.0.1

OpenOffice OpenOffice 2.0.2

OpenOffice OpenOffice 2.0.3

OpenOffice OpenOffice 2.0.3 -1

OpenOffice OpenOffice 2.0.4

References

References:

PhpLog

BNLug Benevento Linux Users Group