Heap-based buffer overflow in OpenOffice.org (OOo) 2.2.1 and earlier allows remote attackers to execute arbitrary code via a RTF file with a crafted prtdata tag with a length parameter inconsistency, which causes vtable entries to be overwritten.

StarSuite 8 (Solaris_x86): Update 18.
Date this patch was last updated by Sun : Mar/15/11

StarOffice 8 (Solaris_x86): Update 18.
Date this patch was last updated by Sun : Mar/15/11

StarSuite 8 (Solaris): Update 18.
Date this patch was last updated by Sun : Mar/15/11

StarOffice 8 (Solaris): Update 18.
Date this patch was last updated by Sun : Mar/15/11

From Red Hat Security Advisory 2007:0406 :

Updated openoffice.org packages to correct a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

OpenOffice.org is an office productivity suite that includes desktop applications such as a word processor, spreadsheet, presentation manager, formula editor, and drawing program.

A heap overflow flaw was found in the RTF import filer. An attacker could create a carefully crafted RTF file that could cause OpenOffice.org to crash or possibly execute arbitrary code if the file was opened by a victim. (CVE-2007-0245)

All users of OpenOffice.org are advised to upgrade to these updated packages, which contain a backported fix to correct this issue.

A heap overflow flaw was found in the RTF import filer. An attacker could create a carefully crafted RTF file that could cause OpenOffice.org to crash or possibly execute arbitrary code if the file was opened by a victim. (CVE-2007-0245)

This update of OpenOffice_org fixes a heap-overflow in the RTF parser and additional non-security bugs. (CVE-2007-0245)

John Heasman discovered that OpenOffice did not correctly validate the sizes of tags in RTF documents. If a user were tricked into opening a specially crafted document, a remote attacker could execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes a possible buffer overrun in hand-crafted rtf files that use the custom /prtdata tag.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A heap overflow flaw was found in the RTF import filter of OpenOffice.org. If a victim were to open a specially crafted RTF file, OpenOffice.org could crash or possibly execute arbitrary code.

Updated packages have been patched to prevent the above issues.

The remote host is affected by the vulnerability described in GLSA-200707-02 (OpenOffice.org: Two buffer overflows)

    John Heasman of NGSSoftware has discovered a heap-based buffer overflow     when parsing the 'prdata' tag in RTF files where the first token is     smaller than the second one (CVE-2007-0245). Additionally, the     OpenOffice binary program is shipped with a version of FreeType that     contains an integer signedness error in the n_points variable in file     truetype/ttgload.c, which was covered by GLSA 200705-22     (CVE-2007-2754).
  Impact :

    A remote attacker could entice a user to open a specially crafted     document, possibly leading to execution of arbitrary code with the     rights of the user running OpenOffice.org.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of Sun Microsystems OpenOffice.org that is affected by a heap-based buffer overflow in its RTF document parser that is triggered when parsing 'prtdata' tags. If a remote attacker can trick a user into opening a specially crafted RTF document, he can execute arbitrary code on the remote host subject to the user's privileges.

Updated openoffice.org packages to correct a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

OpenOffice.org is an office productivity suite that includes desktop applications such as a word processor, spreadsheet, presentation manager, formula editor, and drawing program.

A heap overflow flaw was found in the RTF import filer. An attacker could create a carefully crafted RTF file that could cause OpenOffice.org to crash or possibly execute arbitrary code if the file was opened by a victim. (CVE-2007-0245)

All users of OpenOffice.org are advised to upgrade to these updated packages, which contain a backported fix to correct this issue.

John Heasman discovered a heap overflow in the routines of OpenOffice.org that parse RTF files. A specially crafted RTF file could cause the filter to overwrite data on the heap, which may lead to the execution of arbitrary code.

ID	Name	Product	Family	Severity
107858	Solaris 10 (x86) : 120190-23	Nessus	Solaris Local Security Checks	high
107857	Solaris 10 (x86) : 120186-23	Nessus	Solaris Local Security Checks	high
107356	Solaris 10 (sparc) : 120189-23	Nessus	Solaris Local Security Checks	high
107355	Solaris 10 (sparc) : 120185-23	Nessus	Solaris Local Security Checks	high
67513	Oracle Linux 3 / 4 : openoffice.org (ELSA-2007-0406)	Nessus	Oracle Linux Local Security Checks	high
60206	Scientific Linux Security Update : openoffice.org on SL4.x, i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60205	Scientific Linux Security Update : openoffice.org on SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
29366	SuSE 10 Security Update : OpenOffice_org (ZYPP Patch Number 3761)	Nessus	SuSE Local Security Checks	high
28083	Ubuntu 6.06 LTS / 6.10 / 7.04 : openoffice.org(2)/-amd64 vulnerability (USN-482-1)	Nessus	Ubuntu Local Security Checks	high
27665	Fedora 7 : openoffice.org-2.2.0-14.11 (2007-0410)	Nessus	Fedora Local Security Checks	high
27139	openSUSE 10 Security Update : OpenOffice_org (OpenOffice_org-3626)	Nessus	SuSE Local Security Checks	high
27138	openSUSE 10 Security Update : OpenOffice_org (OpenOffice_org-3530)	Nessus	SuSE Local Security Checks	high
25697	Mandrake Linux Security Advisory : openoffice.org (MDKSA-2007:144)	Nessus	Mandriva Local Security Checks	high
25660	GLSA-200707-02 : OpenOffice.org: Two buffer overflows	Nessus	Gentoo Local Security Checks	high
25552	Sun OpenOffice.org RTF Parser prtdata Tag Buffer Overflow	Nessus	Windows	high
25520	RHEL 3 / 4 / 5 : openoffice.org (RHSA-2007:0406)	Nessus	Red Hat Local Security Checks	high
25506	Debian DSA-1307-1 : openoffice.org - heap overflow	Nessus	Debian Local Security Checks	high
25495	CentOS 3 / 4 / 5 : openoffice / openoffice.org (CESA-2007:0406)	Nessus	CentOS Local Security Checks	high

Detections

Analytics

CVE-2007-0245

critical

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high