The StgCompObjStream::Load function in OpenOffice.org OpenOffice 1.1.4 and earlier allocates memory based on 16 bit length values, but process memory using 32 bit values, which allows remote attackers to cause a denial of service and possibly execute arbitrary code via a DOC document with certain length values, which leads to a heap-based buffer overflow.

Updated openoffice.org packages are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

OpenOffice.org is an office productivity suite that includes desktop applications such as a word processor, spreadsheet, presentation manager, formula editor, and drawing program.

A heap based buffer overflow bug was found in the OpenOffice.org DOC file processor. An attacker could create a carefully crafted DOC file in such a way that it could cause OpenOffice.org to execute arbitrary code when the file was opened by a victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0941 to this issue.

All users of OpenOffice.org are advised to upgrade to these updated packages, which contain backported fixes for these issues.

The StgCompObjStream::Load() failed to check the validity of a length field in documents. If an attacker tricked a user to open a specially crafted OpenOffice file, this triggered a buffer overflow which could lead to arbitrary code execution with the privileges of the user opening the document.

The update for Ubuntu 5.04 (Hoary Hedgehog) also contains a translation update: The 'openoffice.org-l10n-xh' package now contains actual Xhosa translations (the previous version just shipped English strings).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

AD-LAB reports that a heap-based buffer overflow vulnerability exists in OpenOffice's handling of DOC documents. When reading a DOC document 16 bit from a 32 bit integer is used for memory allocation, but the full 32 bit is used for further processing of the document. This can allow an attacker to crash OpenOffice, or potentially execute arbitrary code as the user running OpenOffice, by tricking an user into opening a specially crafted DOC document.

AD-LAB discovered a heap overflow in the StgCompObjStream::Load() function when OpenOffice.org processes DOC documents. If an attacker created a malicious DOC document that contained a specially crafted header, it could execute arbitrary code with the rights of the user running OpenOffice.org.

The updated packages have been patched to prevent this problem.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2005:375 advisory.

  - security flaw (CVE-2005-0941)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is missing the patch for the advisory SUSE-SA:2005:025 (OpenOffice_org).


This security update fixes a buffer overflow in OpenOffice_org Microsoft Word document reader which could allow a remote attacker sending a handcrafted .doc file to execute code as the user opening the document in OpenOffice.

This is tracked by the Mitre CVE ID CVE-2005-0941.


WARNING: The updated packages are very large for distributions before SUSE Linux 9.2 and 9.3.

The minimum download sizes for those are:
SUSE Linux Desktop 1:   47 MB Novell Linux Desktop 9: 41 MB SUSE Linux 8.2:         37 MB SUSE Linux 9.0:         46 MB SUSE Linux 9.1:         50 MB SUSE Linux 9.2:          2.1 MB (using delta rpm) SUSE Linux 9.3:          3.5 MB (using delta rpm)

The remote host is affected by the vulnerability described in GLSA-200504-13 (OpenOffice.Org: DOC document Heap Overflow)

    AD-LAB has discovered a heap overflow in the 'StgCompObjStream::Load()'     function when processing DOC documents.
  Impact :

    An attacker could design a malicious DOC document containing a     specially crafted header which, when processed by OpenOffice.Org, would     result in the execution of arbitrary code with the rights of the user     running the application.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
21813	CentOS 3 / 4 : OpenOffice.org (CESA-2005:375)	Nessus	CentOS Local Security Checks	medium
20510	Ubuntu 4.10 / 5.04 : openoffice.org vulnerability (USN-121-1)	Nessus	Ubuntu Local Security Checks	medium
19084	FreeBSD : openoffice -- DOC document heap overflow vulnerability (b206dd82-ac67-11d9-a788-0001020eed82)	Nessus	FreeBSD Local Security Checks	medium
18236	Mandrake Linux Security Advisory : OpenOffice.org (MDKSA-2005:082)	Nessus	Mandriva Local Security Checks	medium
18129	RHEL 4 : openoffice.org (RHSA-2005:375)	Nessus	Red Hat Local Security Checks	critical
18096	SUSE-SA:2005:025: OpenOffice_org	Nessus	SuSE Local Security Checks	medium
18060	GLSA-200504-13 : OpenOffice.Org: DOC document Heap Overflow	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2005-0941

critical

Tenable Plugins

medium

medium

medium

medium

critical

medium

medium