The Impress tool in Apache OpenOffice 4.1.2 and earlier allows remote attackers to cause a denial of service (out-of-bounds read or write) or execute arbitrary code via crafted MetaActions in an (1) ODP or (2) OTP file.

The remote host is affected by the vulnerability described in GLSA-201703-01 (OpenOffice: User-assisted execution of arbitrary code)

    An exploitable out-of-bounds vulnerability exists in OpenOffice Impress       when handling MetaActions.
  Impact :

    A remote attacker could entice a user to open a specially crafted       OpenDocument Presentation .ODP or Presentation Template .OTP file using       OpenOffice Impress, possibly resulting in execution of arbitrary code       with the privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The version of Apache OpenOffice installed on the remote host is a version prior to 4.1.3. It is, therefore, affected by the following vulnerabilities :

  - A memory corruption issue exists in the Impress tool due     to improper validation of user-supplied input when     handling elements in invalid presentations. An     unauthenticated, remote attacker can exploit this, via     specially crafted MetaActions in an ODP or OTP file, to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-1513)

  - A privilege escalation vulnerability exists due to the     use of an unquoted Windows search path. A local attacker     can exploit this to execute arbitrary code with elevated     privileges. (CVE-2016-6803)

  - A privilege escalation vulnerability exists due to the     use of a fixed path to load system binaries. A local     attacker can exploit this, via a specially crafted DLL     file in the library path, to inject and execute     arbitrary code with elevated privileges. (CVE-2016-6804)

An OpenDocument Presentation .ODP or Presentation Template .OTP file can contain invalid presentation elements that lead to memory corruption when the document is loaded in LibreOffice Impress. The defect may cause the document to appear as corrupted and LibreOffice may crash in a recovery-stuck mode requiring manual intervention. A crafted exploitation of the defect can allow an attacker to cause denial of service (memory corruption and application crash) and possible execution of arbitrary code.

For Debian 7 'Wheezy', this problem have been fixed in version 3.5.4+dfsg2-0+deb7u8.

We recommend that you upgrade your libreoffice packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Yves Younan and Richard Johnson discovered that LibreOffice incorrectly handled presentation files. If a user were tricked into opening a specially crafted presentation file, a remote attacker could cause LibreOffice to crash, and possibly execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Apache OpenOffice Project reports :

An OpenDocument Presentation .ODP or Presentation Template .OTP file can contain invalid presentation elements that lead to memory corruption when the document is loaded in Apache OpenOffice Impress.
The defect may cause the document to appear as corrupted and OpenOffice may crash in a recovery-stuck mode requiring manual intervention. A crafted exploitation of the defect can allow an attacker to cause denial of service (memory corruption and application crash) and possible execution of arbitrary code.

ID	Name	Product	Family	Severity
97813	GLSA-201703-01 : OpenOffice: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
94199	Apache OpenOffice < 4.1.3 Multiple Vulnerabilities	Nessus	Windows	high
92829	Debian DLA-591-1 : libreoffice security update	Nessus	Debian Local Security Checks	high
92750	Ubuntu 12.04 LTS : libreoffice vulnerability (USN-3046-1)	Nessus	Ubuntu Local Security Checks	high
92504	FreeBSD : Apache OpenOffice 4.1.2 -- Memory Corruption Vulnerability (Impress Presentations) (72f71e26-4f69-11e6-ac37-ac9e174be3af)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2016-1513

high

Tenable Plugins

high

high

high

high

high