| Description: | Summary:
The remote host is missing an update for the 'openoffice.org' package(s) announced via the USN-903-1 advisory.
Vulnerability Insight:
It was discovered that the XML HMAC signature system did not
correctly check certain lengths. If an attacker sent a truncated
HMAC, it could bypass authentication, leading to potential privilege
escalation. (CVE-2009-0217)
Sebastian Apelt and Frank Reissner discovered that OpenOffice did not
correctly import XPM and GIF images. If a user were tricked into opening
a specially crafted image, an attacker could execute arbitrary code with
user privileges. (CVE-2009-2949, CVE-2009-2950)
Nicolas Joly discovered that OpenOffice did not correctly handle
certain Word documents. If a user were tricked into opening a specially
crafted document, an attacker could execute arbitrary code with user
privileges. (CVE-2009-3301, CVE-2009-3302)
It was discovered that OpenOffice did not correctly handle certain
VBA macros correctly. If a user were tricked into opening a specially
crafted document, an attacker could execute arbitrary macro commands,
bypassing security controls. (CVE-2010-0136)
Affected Software/OS:
'openoffice.org' package(s) on Ubuntu 8.04, Ubuntu 8.10, Ubuntu 9.04, Ubuntu 9.10.
Solution:
Please install the updated package(s).
CVSS Score:
9.3
CVSS Vector:
AV:N/AC:M/Au:N/C:C/I:C/A:C
|
