Apache OpenOffice before 4.1.1 allows remote attackers to execute arbitrary commands and possibly have other unspecified impact via a crafted Calc spreadsheet.

The remote host is affected by the vulnerability described in GLSA-201603-05 (LibreOffice, OpenOffice: Multiple vulnerabilities)

    Multiple vulnerabilities were found in both LibreOffice and OpenOffice       that allow the remote execution of arbitrary code and potential Denial of       Service.  These vulnerabilities may be exploited through multiple vectors       including crafted documents, link handling, printer setup in ODF document       types, DOC file formats, and Calc spreadsheets.  Please review the       referenced CVE&rsquo;s for specific information regarding each.
  Impact :

    A remote attacker could entice a user to open a specially crafted file       using the LibreOffice or OpenOffice suite of software.  Execution of       these attacks could possibly result in the execution of arbitrary code       with the privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known work around at this time.

A version of LibreOffice is installed on the remote Windows host that is 4.3.x prior to 4.3.1. It is, therefore, affected by the following vulnerabilities :

  - An input-validation error exists related to handling     Calc spreadsheets that allows arbitrary command     execution. (CVE-2014-3524)

  - An input-validation error exists related to 'Update     Links' prompt handling that allows information     disclosure via improperly included OLE2 previews.
    (CVE-2014-3575)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

A version of LibreOffice is installed on the remote Windows host that is 4.x prior to 4.2.6-secfix (4.2.6.3). It is, therefore, affected by the following vulnerabilities :

  - An input-validation error exists related to handling     Calc spreadsheets that allows arbitrary command     execution. (CVE-2014-3524)

  - An input-validation error exists related to 'Update     Links' prompt handling that allows information     disclosure via improperly included OLE2 previews.
    (CVE-2014-3575)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2331-1 advisory.

    Rohan Durve and James Kettle discovered LibreOffice Calc sometimes allowed for command injection when     opening spreadsheets. If a user were tricked into opening a crafted Calc spreadsheet, an attacker could     exploit this to run programs as your login.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache OpenOffice installed on the remote host is a version prior to 4.1.1. It is, therefore, affected by the following vulnerabilities :

  - An unspecified flaw allows remote attackers to execute     arbitrary commands via a specially crafted Calc     spreadsheet. (CVE-2014-3524)

  - A flaw in the OLE preview generation allows a remote     attacker to embed arbitrary data into documents via     specially crafted OLE objects. (CVE-2014-3575)

ID	Name	Product	Family	Type	Severity
89811	GLSA-201603-05 : LibreOffice, OpenOffice: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	high
80080	LibreOffice 4.3.x < 4.3.1 Multiple Vulnerabilities	Nessus	Windows	Local	high
80078	LibreOffice 4.x < 4.2.6-secfix (4.2.6.3) Multiple Vulnerabilities	Nessus	Windows	Local	high
77487	Ubuntu 14.04 LTS : LibreOffice vulnerability (USN-2331-1)	Nessus	Ubuntu Local Security Checks	Local	critical
77408	Apache OpenOffice < 4.1.1 Multiple Vulnerabilities	Nessus	Windows	Local	high

Detections

Analytics

CVE-2014-3524

critical

Tenable Plugins

high

high

high

critical

high