—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1
Liebe Kolleginnen und Kollegen,
soeben erreichte uns nachfolgendes Sun Security Advisory. Wir geben
diese Informationen unveraendert an Sie weiter.
Sun hat bereits ein Advisory zu einer aehnlichen Schwachstelle beim
Einlesen von EMF-Dateien herausgegeben. Offenbar wurden beide Fehler
im gleichen Update behoben, da in diesem Advisory auf die gleichen
Patches verwiesen wird.
StarOffice und OpenOffice beruhen in weiten Teilen auf dem gleichen
Quellcode und sind daher teilweise von den gleichen Schwachstellen
betroffen.
CVE-2008-2237 – Heap Overflow im OpenOffice WMF Dateiparser
OpenOffice beinhaltet eine Schwachstelle bei der Verarbeitung von
WMF-Dateien, welche zu einem Heap Overflow fuehren kann. Ein Angreifer
kann diese Schwachstelle dazu ausnutzen, beliebigen Code mit den
Rechten des OpenOffice Benutzers auszufuehren, indem er ihn dazu
bringt, ein entsprechend manipulierter WMF-Datei zu oeffnen, z.B. als
Anhang in einer E-Mail oder in einer Webseite.
Betroffen sind die folgenden Software Pakete und Plattformen:
StarOffice 7 Software
StarSuite 7 Software
StarOffice 8 Software
StarSuite 8 Software
SPARC Plattform
* StarOffice/StarSuite 7 ohne Patch 13 (patch 116519-17)
* StarOffice 8 ohne Update 12 (patch 120185-17)
* StarSuite 8 ohne Update 12 (patch 120189-17)
x86 Plattform
* StarOffice/StarSuite 7 ohne Patch 13 (patch 117073-15)
* StarOffice 8 ohne Update 12 (patch 120186-17)
* StarSuite 8 ohne Update 12 (patch 120190-17)
Linux Plattform
* StarOffice/StarSuite 7 ohne Patch 13 (patch 116518-17)
* StarOffice 8 ohne Update 12 (patch 120184-16)
* StarSuite 8 ohne Update 12 (patch 120188-16)
Windows Plattform
* StarOffice/StarSuite 7 ohne Patch 13 (patch 116520-16)
* StarOffice 8 ohne Update 12 (patch 120187-16)
* StarSuite 8 ohne Update 12 (patch 120191-16)
* StarSuite 8 Impress Standalone
Vom Hersteller werden ueberarbeitete Pakete zur Verfuegung gestellt.
Hersteller Advisory:
http://sunsolve.sun.com/search/document.do?assetkey=1-66-242627-1
(c) der deutschen Zusammenfassung bei DFN-CERT Services GmbH; die
Verbreitung, auch auszugsweise, ist nur unter Hinweis auf den Urheber,
DFN-CERT Services GmbH, und nur zu nicht kommerziellen Zwecken
gestattet.
Mit freundlichen Gruessen,
Andreas Bunten, DFN-CERT
– —
Andreas Bunten (Incident Response Team), +49 40 808077-555
DFN-CERT Services GmbH, https://www.dfn-cert.de, Phone +49 40 808077-555
Sitz / Register: Hamburg, AG Hamburg, HRB 88805, Ust-IdNr.: DE 232129737
Sachsenstrasse 5, 20097 Hamburg/Germany, CEO: Dr. Klaus-Peter Kossakowski
Automatische Warnmeldungen https://www.cert.dfn.de/autowarn
Solution Type Sun Alert
Solution 242627 : Security Vulnerability in StarOffice Related to
.wmf Files May Lead to Heap Overflows and Arbitrary Code Execution
Related Categories
* Home>Content>Sun Alert Criteria Categories>Security
* Home>Content>Sun Alert Release Phase>Resolved
Bug ID
6749452
Product
StarOffice 7 Software
StarSuite 7 Software
StarOffice 8 Software
StarSuite 8 Software
Date of Resolved Release
13-Nov-2008
SA Document Body
A security vulnerability with the way StarOffice/StarSuite 7 and 8 process Wind
ows Metafile (.wmf) files:
1. Impact
A security vulnerability with the way StarOffice/StarSuite 7 and 8
process Windows Metafile (.wmf) files may allow a remote unprivileged
user who provides a StarOffice/StarSuite document that is opened by a
local user to execute arbitrary commands on the system with the
privileges of the user running StarOffice/StarSuite.
This issue is described in the following document:
CVE-2008-2237 at:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2008-2237
Sun acknowledges with thanks, an anonymous researcher working with the
SureRun security team (http://www.SureRun.cn).
2. Contributing Factors
This issue can occur in the following releases:
SPARC Platform
* StarOffice/StarSuite 7 without product patch 13 (patch 116519-17)
* StarOffice 8 without update 12 (patch 120185-17)
* StarSuite 8 without update 12 (patch 120189-17)
x86 Platform
* StarOffice/StarSuite 7 without product patch 13 (patch 117073-15)
* StarOffice 8 without update 12 (patch 120186-17)
* StarSuite 8 without update 12 (patch 120190-17)
Linux Platform
* StarOffice/StarSuite 7 without product patch 13 (patch 116518-17)
* StarOffice 8 without update 12 (patch 120184-16)
* StarSuite 8 without update 12 (patch 120188-16)
Windows Platform
* StarOffice/StarSuite 7 without product patch 13 (patch 116520-16)
* StarOffice 8 without update 12 (patch 120187-16)
* StarSuite 8 without update 12 (patch 120191-16)
* StarSuite 8 Impress Standalone
Note: Earlier versions of StarOffice and StarSuite will not be
evaluated regarding this issue.
To determine the version of StarOffice/StarSuite installed on a system,
the following command can be run (for
% grep Product bootstraprc
ProductKey=StarOffice 8
ProductPatch=(Product Update 12)
Or by using the GUI, do the following (with StarOffice/StarSuite open):
1. Open the “Help” menu
2. Choose “About StarOffice” (StarSuite)
The version is displayed first in the “about” text.
3. Symptoms
There are no predictable symptoms that would indicate this issue has
occurred.
4. Workaround
There is no workaround for this issue. Please see the Resolution
section below.
5. Resolution
This issue is addressed in the following releases:
SPARC Platform
* StarOffice/StarSuite 7 with product patch 13 (patch 116519-17) or
later
* StarOffice 8 with update 12 (patch 120185-17) or later
* StarSuite 8 with update 12 (patch 120189-17) or later
x86 Platform
* StarOffice/StarSuite 7 with product patch 13 (patch 117073-15) or
later
* StarOffice 8 with update 12 (patch 120186-17) or later
* StarSuite 8 with update 12 (patch 120190-17) or later
Linux Platform
* StarOffice/StarSuite 7 with product patch 13 (patch 116518-17) or
later
* StarOffice 8 with update 12 (patch 120184-16) or later
* StarSuite 8 with update 12 (patch 120188-16) or later
Windows Platform
* StarOffice/StarSuite 7 with product patch 13 (patch 116520-16) or
later
* StarOffice 8 with update 12 (patch 120187-16) or later
* StarSuite 8 with update 12 (patch 120191-16) or later
A final resolution is pending completion for Windows StarSuite 8
Impress Standalone.
For more information on Security Sun Alerts, see Technical Instruction
ID 213557.
This Sun Alert notification is being provided to you on an “AS IS”
basis. This Sun Alert notification may contain information provided by
third parties. The issues described in this Sun Alert notification may
or may not impact your system(s). Sun makes no representations,
warranties, or guarantees as to the information contained herein. ANY
AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION
WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR
NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU
ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT,
INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT
OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This
Sun Alert notification contains Sun proprietary and confidential
information. It is being provided to you pursuant to the provisions of
your agreement to purchase services from Sun, or, if you do not have
such an agreement, the Sun.com Terms of Use. This Sun Alert
notification may only be used for the purposes contemplated by these
agreements.
Copyright 2000-2008 Sun Microsystems, Inc., 4150 Network Circle, Santa
Clara, CA 95054 U.S.A. All rights reserved.
Attachments
This solution has no attachment
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.2 (GNU/Linux)
iD8DBQFKZFtmk0kIxZMiiQ8RAnulAJ0Q2tpptEGizWYpPtDV6GOY7sTdLwCdF7vz
0WbiC69H478FwPTxF7xltk4=
=NSVQ
—–END PGP SIGNATURE—–
