Heap-based buffer overflow in OpenOffice.org (OOo) before 3.1.1 and StarOffice/StarSuite 7, 8, and 9 might allow remote attackers to execute arbitrary code via unspecified records in a crafted Word document, related to "table parsing."

The remote host is affected by the vulnerability described in GLSA-201408-19 (OpenOffice, LibreOffice: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenOffice and       Libreoffice. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could entice a user to open a specially crafted file       using OpenOffice, possibly resulting in execution of arbitrary code with       the privileges of the process, a Denial of Service condition, execution       of arbitrary Python code, authentication bypass, or reading and writing       of arbitrary files.
  Workaround :

    There is no known workaround at this time.

From Red Hat Security Advisory 2009:1426 :

Updated openoffice.org packages that correct security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

OpenOffice.org is an office productivity suite that includes desktop applications, such as a word processor, spreadsheet, presentation manager, formula editor, and a drawing program.

An integer underflow flaw and a boundary error flaw, both possibly leading to a heap-based buffer overflow, were found in the way OpenOffice.org parses certain records in Microsoft Word documents. An attacker could create a specially crafted Microsoft Word document, which once opened by an unsuspecting user, could cause OpenOffice.org to crash or, potentially, execute arbitrary code with the permissions of the user running OpenOffice.org. (CVE-2009-0200, CVE-2009-0201)

All users of OpenOffice.org are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
All running instances of OpenOffice.org applications must be restarted for this update to take effect.

Updated openoffice.org packages that correct security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

OpenOffice.org is an office productivity suite that includes desktop applications, such as a word processor, spreadsheet, presentation manager, formula editor, and a drawing program.

An integer underflow flaw and a boundary error flaw, both possibly leading to a heap-based buffer overflow, were found in the way OpenOffice.org parses certain records in Microsoft Word documents. An attacker could create a specially crafted Microsoft Word document, which once opened by an unsuspecting user, could cause OpenOffice.org to crash or, potentially, execute arbitrary code with the permissions of the user running OpenOffice.org. (CVE-2009-0200, CVE-2009-0201)

All users of OpenOffice.org are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
All running instances of OpenOffice.org applications must be restarted for this update to take effect.

CVE-2009-0200 OpenOffice.org Word document Integer Underflow

CVE-2009-0201 OpenOffice.org Word document buffer overflow

An integer underflow flaw and a boundary error flaw, both possibly leading to a heap-based buffer overflow, were found in the way OpenOffice.org parses certain records in Microsoft Word documents. An attacker could create a specially crafted Microsoft Word document, which once opened by an unsuspecting user, could cause OpenOffice.org to crash or, potentially, execute arbitrary code with the permissions of the user running OpenOffice.org. (CVE-2009-0200, CVE-2009-0201)

Allrunning instances of OpenOffice.org applications must be restarted for this update to take effect.

Note: The openoffice.org2 update for SL4 has been delayed.

This update of OpenOffice.org fixes potential buffer overflow in EMF parser code (enhwmf.cxx, emfplus.cxx). Additionally Secunia reported an integer underflow (CVE-2009-0200) and a buffer overflow (CVE-2009-0201) that could be triggered while parsing Word documents.

Also provides the maintenance update to OpenOffice.org-3.1.1.

This update of OpenOffice.org fixes potential buffer overflow in EMF parser code (enhwmf.cxx, emfplus.cxx) (Thanks to Petr Mladek).
Additionally Secunia reported an integer underflow (CVE-2009-0200) and a buffer overflow (CVE-2009-0201) that could be triggered while parsing Word documents.

Also provides the maintenance update to OpenOffice.org-3.1.1.

Details about all upstream changes can be found at http://development.openoffice.org/releases/3.1.1.html

This updates provides a new OpenOffice.org version 3.1.1. It holds security and bug fixes described as follow :

An integer underflow might allow remote attackers to execute arbitrary code via crafted records in the document table of a Word document, leading to a heap-based buffer overflow (CVE-2009-0200).

A heap-based buffer overflow might allow remote attackers to execute arbitrary code via unspecified records in a crafted Word document, related to table parsing (CVE-2009-0201).

A heap-based buffer overflow allows remote attackers to execute arbitrary code via a crafted EMF file (CVE-2009-2139).

Multiple heap-based buffer overflows allow remote attackers to execute arbitrary code via a crafted EMF+ file (CVE-2009-2140).

OpenOffice's xmlsec uses a bundled Libtool which might load .la file in the current working directory allowing local users to gain privileges via a Trojan horse file. For enabling such vulnerability xmlsec has to use --enable-crypto_dl building flag however it does not, although the fix keeps protected against this threat whenever that flag had been enabled (CVE-2009-3736).

Further this update provides following bug fixes :

OpenOffice.org is not properly configure to use the xdg-email functionality of the FreeDesktop standard (#52195).

As the template desktop icons are not properly set, it's not presented under the context menu of applications like Dolphin (#56439).

The Firefox plugin which enables viewing of OpenOffice documents inside the browser was not enabled.

This updates provides a new OpenOffice.org version 3.1.1. It holds security and bug fixes described as follow :

An integer underflow might allow remote attackers to execute arbitrary code via crafted records in the document table of a Word document, leading to a heap-based buffer overflow (CVE-2009-0200).

A heap-based buffer overflow might allow remote attackers to execute arbitrary code via unspecified records in a crafted Word document, related to table parsing (CVE-2009-0201).

A heap-based buffer overflow allows remote attackers to execute arbitrary code via a crafted EMF file (CVE-2009-2139).

Multiple heap-based buffer overflows allow remote attackers to execute arbitrary code via a crafted EMF+ file (CVE-2009-2140).

OpenOffice's xmlsec uses a bundled Libtool which might load .la file in the current working directory allowing local users to gain privileges via a Trojan horse file. For enabling such vulnerability xmlsec has to use --enable-crypto_dl building flag however it does not, although the fix keeps protected against this threat whenever that flag had been enabled (CVE-2009-3736).

Addittionaly this update provides following bug fixes :

OpenOffice.org is not properly configure to use the xdg-email functionality of the FreeDesktop standard (#52195).

Template desktop icons are not properly set up then they are not presented under the context menu of applications like Dolphin (#56439).

libia_ora-gnome is added as suggest as long as that package is needed for a better look (#57385#c28).

It is enabled a fallback logic to properly select an OpenOffice.org style whenever one is set up but that is not installed (#57530#c1, #53284, #45133, #39043)

It is enabled the Firefox plugin for viewing OpenOffice.org documents inside browser.

Further packages were provided to supply OpenOffice.org. 3.1.1 dependencies.

This update provides the OpenOffice.org 3.0 major version and holds the security fixes for the following issues :

An integer underflow might allow remote attackers to execute arbitrary code via crafted records in the document table of a Word document leading to a heap-based buffer overflow (CVE-2009-0200).

An heap-based buffer overflow might allow remote attackers to execute arbitrary code via unspecified records in a crafted Word document related to table parsing. (CVE-2009-0201).

Multiple heap-based buffer overflows allow remote attackers to execute arbitrary code via a crafted EMF+ file (CVE-2009-2140).

OpenOffice's xmlsec uses a bundled Libtool which might load .la file in the current working directory allowing local users to gain privileges via a Trojan horse file. For enabling such vulnerability xmlsec has to use --enable-crypto_dl building flag however it does not, although the fix keeps protected against this threat whenever that flag had been enabled (CVE-2009-3736).

Additional packages are also being provided due to dependencies.

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers.

Several vulnerabilities have been discovered in the OpenOffice.org office suite. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-0200     Dyon Balding of Secunia Research has discovered a     vulnerability, which can be exploited by opening a     specially crafted Microsoft Word document.

  When reading a Microsoft Word document, a bug in the parser of   sprmTDelete records can result in an integer underflow that may lead   to heap-based buffer overflows.

  Successful exploitation may allow arbitrary code execution in the   context of the OpenOffice.org process.

  - CVE-2009-0201     Dyon Balding of Secunia Research has discovered a     vulnerability, which can be exploited by opening a     specially crafted Microsoft Word document.

  When reading a Microsoft Word document, a bug in the parser of   sprmTDelete records can result in heap-based buffer overflows.

  Successful exploitation may allow arbitrary code execution in the   context of the OpenOffice.org process.

  - CVE-2009-2139     A vulnerability has been discovered in the parser of EMF     files of OpenOffice/Go-oo 2.x and 3.x that can be     triggered by a specially crafted document and lead to     the execution of arbitrary commands the privileges of     the user running OpenOffice.org/Go-oo.

  This vulnerability does not exist in the packages for oldstable,   testing and unstable.

Secunia reported an integer underflow (CVE-2009-0200) and a buffer overflow (CVE-2009-0201) that could be triggered while parsing Word documents.

Dyon Balding discovered flaws in the way OpenOffice.org handled tables. If a user were tricked into opening a specially crafted Word document, a remote attacker might be able to execute arbitrary code with user privileges. (CVE-2009-0200, CVE-2009-0201)

A memory overflow flaw was discovered in OpenOffice.org's handling of EMF files. If a user were tricked into opening a specially crafted document, a remote attacker might be able to execute arbitrary code with user privileges. (CVE-2009-2139).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of OpenOffice.org fixes potential buffer overflow in EMF parser code (CVE-2009-2139, CVE-2009-2140) (Thanks to Petr Mladek).
Additionally Secunia reported an integer underflow (CVE-2009-0200) and a buffer overflow (CVE-2009-0201) that could be triggered while parsing Word documents.

CVE-2009-0200/CVE-2009-0201: Harden .doctable insert/delete record import handling.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of OpenOffice is earlier than 3.1.1.  Such versions are potentially affected by several issues : 

  - A boundary error when parsing certain records can be exploited to cause a heap-based buffer overflow via a specially crafted document. (CVE-2009-0201)

  - An integer underflow error when parsing certain records in the document table. (CVE-2009-0200)

  - A vulnerability in the parser of EMFS files can lead to the execution of arbitrary commands. (CVE-2009-2139)

The version of OpenOffice installed on the remote host is earlier than 3.1.1. Such versions are affected by several issues :

  - Parsing certain records in a document table could lead     to heap-based overflows and arbitrary code execution.            (CVE-2009-0200)

  - Parsing certain records in specially crafted files could     lead to heap-based overflows and arbitrary code     execution. (CVE-2009-0201)

ID	Name	Product	Family	Severity
77467	GLSA-201408-19 : OpenOffice, LibreOffice: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
67919	Oracle Linux 3 / 4 : openoffice.org (ELSA-2009-1426)	Nessus	Oracle Linux Local Security Checks	high
63895	RHEL 3 / 4 / 5 : openoffice.org (RHSA-2009:1426)	Nessus	Red Hat Local Security Checks	high
60661	Scientific Linux Security Update : openoffice.org on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
51683	SuSE 10 Security Update : OpenOffice_org (ZYPP Patch Number 6469)	Nessus	SuSE Local Security Checks	high
51593	SuSE 11 Security Update : OpenOffice_org (SAT Patch Number 1258)	Nessus	SuSE Local Security Checks	high
48172	Mandriva Linux Security Advisory : openoffice.org (MDVSA-2010:035)	Nessus	Mandriva Local Security Checks	high
46699	Mandriva Linux Security Advisory : openoffice.org (MDVSA-2010:105)	Nessus	Mandriva Local Security Checks	high
44996	Mandriva Linux Security Advisory : openoffice.org (MDVSA-2010:056)	Nessus	Mandriva Local Security Checks	high
44745	Debian DSA-1880-1 : openoffice.org - several vulnerabilities	Nessus	Debian Local Security Checks	high
41988	openSUSE 10 Security Update : OpenOffice_org (OpenOffice_org-6421)	Nessus	SuSE Local Security Checks	high
41969	Ubuntu 8.04 LTS / 8.10 / 9.04 : openoffice.org vulnerabilities (USN-840-1)	Nessus	Ubuntu Local Security Checks	high
41361	SuSE 11 Security Update : OpenOffice_org (SAT Patch Number 1258)	Nessus	SuSE Local Security Checks	high
40883	openSUSE Security Update : OpenOffice_org-math (OpenOffice_org-math-1191)	Nessus	SuSE Local Security Checks	high
40881	openSUSE Security Update : OpenOffice_org (OpenOffice_org-1187)	Nessus	SuSE Local Security Checks	high
40878	CentOS 3 / 4 : openoffice.org (CESA-2009:1426)	Nessus	CentOS Local Security Checks	high
40867	Fedora 10 : openoffice.org-3.0.1-15.6.fc10 (2009-9256)	Nessus	Fedora Local Security Checks	high
5145	OpenOffice < 3.1.1 Multiple Vulnerabilities	Nessus Network Monitor	Generic	medium
40826	OpenOffice < 3.1.1 Multiple Buffer Overflows	Nessus	Windows	high

Detections

Analytics

CVE-2009-0201

high

Tenable Plugins

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

medium

high