LibreOffice < 3.4.6 / 3.5.1 XML External Entity RDF Document Handling Information Disclosure (Mac OS X)

This script is Copyright (C) 2012-2014 Tenable Network Security, Inc.


Synopsis :

The remote host is running an application affected by a data leakage
vulnerability.

Description :

The remote host is running a version of LibreOffice < 3.4.6 / 3.5.1
that has flaws in the way certain XML components are processed for
external entities in ODF documents. These flaws can be utilized to
access and inject the content of local files into an ODF document
without a user's knowledge or permission, or inject arbitrary code
that would be executed when opened by the user.

See also :

http://www.libreoffice.org/advisories/CVE-2012-0037/

Solution :

Upgrade to LibreOffice 3.4.6 / 3.5.1 or higher.

Risk factor :

High / CVSS Base Score : 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 8.1
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : true

Family: MacOS X Local Security Checks

Nessus Plugin ID: 58725 ()

Bugtraq ID: 52681

CVE ID: CVE-2012-0037

Ready to Scan Unlimited IPs & Run Compliance Checks?

Upgrade to Nessus Professional today!

Buy Now

Combine the Power of Nessus with the Ease of Cloud

Start your free Nessus Cloud trial now!

Begin Free Trial