1. Ubuntu Security Notices
  2. USN-903-1

USN-903-1: OpenOffice.org vulnerabilities

Publication date

24 February 2010

Overview

OpenOffice.org vulnerabilities

Releases

Packages

Details

It was discovered that the XML HMAC signature system did not
correctly check certain lengths. If an attacker sent a truncated
HMAC, it could bypass authentication, leading to potential privilege
escalation. (CVE-2009-0217)

Sebastian Apelt and Frank Reißner discovered that OpenOffice did not
correctly import XPM and GIF images. If a user were tricked into opening
a specially crafted image, an attacker could execute arbitrary code with
user privileges. (CVE-2009-2949, CVE-2009-2950)

Nicolas Joly discovered that OpenOffice did not correctly handle
certain Word documents. If a user were tricked into opening a specially
crafted document, an attacker could execute arbitrary code with user
privileges. (CVE-2009-3301, CVE-2009-3302)

It was...

It was discovered that the XML HMAC signature system did not
correctly check certain lengths. If an attacker sent a truncated
HMAC, it could bypass authentication, leading to potential privilege
escalation. (CVE-2009-0217)

Sebastian Apelt and Frank Reißner discovered that OpenOffice did not
correctly import XPM and GIF images. If a user were tricked into opening
a specially crafted image, an attacker could execute arbitrary code with
user privileges. (CVE-2009-2949, CVE-2009-2950)

Nicolas Joly discovered that OpenOffice did not correctly handle
certain Word documents. If a user were tricked into opening a specially
crafted document, an attacker could execute arbitrary code with user
privileges. (CVE-2009-3301, CVE-2009-3302)

It was discovered that OpenOffice did not correctly handle certain
VBA macros correctly. If a user were tricked into opening a specially
crafted document, an attacker could execute arbitrary macro commands,
bypassing security controls. (CVE-2010-0136)

Update instructions

After a standard system upgrade you need to restart OpenOffice to effect the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
9.10 karmic openoffice.org-core –  1:3.1.1-5ubuntu1.1
9.04 jaunty openoffice.org-core –  1:3.0.1-9ubuntu3.2
8.10 intrepid openoffice.org-core –  1:2.4.1-11ubuntu2.3
8.04 hardy openoffice.org-core –  1:2.4.1-1ubuntu2.3

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›