Highly-critical Vulnerabilities Patched In OpenOffice Suite 2.4.2
OpenOffice.org has released a new version of the open-source desktop productivity suite to patch highly-critical vulnerabilities that could expose users to arbitrary code execution attacks.
The flaws, which affect all versions prior to OpenOffice.org 2.4.2, could be exploited via manipulated WMF and EMF files in StarOffice or StarSuite documents:
CVE-2008-2237: A security vulnerability with the way OpenOffice 2.x process WMF files may allow a remote unprivileged user who provides a StarOffice/StarSuite document that is opened by a local user to execute arbitrary commands on the system with the privileges of the user running StarOffice/StarSuite. No working exploit is known right now. There is no workaround.
CVE-2008-2238: A security vulnerability with the way OpenOffice 2.x process EMF files may allow a remote unprivileged user who provides a StarOffice/StarSuite document that is opened by a local user to execute arbitrary commands on the system with the privileges of the user running StarOffice/StarSuite. No working exploit is known right now. There is no workaround.
OpenOffice.org described the bugs as file-handling heap overflows. Patches are available in OpenOffice 2.4.2. OpenOffice 3.0 is not affected by these vulnerabilities.
More on CyberInsecure:
Posts
Leave a Reply
Comments with unsolicited links to other resources will be marked as spam. DO NOT leave links in comments. Please leave your real email, it wont be published.