OpenOffice.org Multiple Vulnerabilities

SA35036

CVE-2009-0200, CVE-2009-0201, CVE-2009-2414, CVE-2009-2416, CVE-2009-3569, CVE-2009-3570, CVE-2009-3571

01 Sep 2009

19 Oct 2009

Highly Critical

Vendor Patch

OpenOffice.org 2.x
OpenOffice.org 3.x

From remote

System access

This covers vulnerabilities where malicious people are able to gain system access and execute arbitrary code with the privileges of a local user.

Some vulnerabilities have been reported in OpenOffice, which can be exploited by malicious people to potentially compromise a user's system.

1) An integer underflow error when parsing certain records can be exploited to cause a heap-based buffer overflow via a specially crafted Microsoft Word document.

2) A boundary error when parsing certain records can be exploited to cause a heap-based buffer overflow via a specially crafted Microsoft Word document.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

The vulnerabilities are confirmed in version 3.1.0. Prior versions may also be affected.

3) Two errors in the processing of XML documents can be exploited to potentially execute arbitrary code via specially crafted XML documents.

This is related to:
SA36631

The vulnerabilities are reported in versions prior to 3.1.1 and 2.4.3.

Update to version 3.1.1 or 2.4.3.

1, 2) Dyon Balding, Secunia Research.
3) Reported by the vendor.

Secunia Research:
http://secunia.com/secunia_research/2009-26/
http://secunia.com/secunia_research/2009-27/

Sun:
http://www.openoffice.org/security/cves/CVE-2009-0200-0201.html
http://www.openoffice.org/security/cves/CVE-2009-2414-2416.html