Bug 299801 (CVE-2007-4575)

Summary:	CVE-2007-4575 OpenOffice.org-base allows Denial-of-Service and command injection
Product:	[Other] Security Response	Reporter:	Marc Schoenefeld <mschoene>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	caolanm, csaldanh, dbhole, fnasser, jprindiv, kreilly, patrickm
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2008-01-14 17:05:46 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	303571, 303601, 303611, 318471, 318491, 318501, 318511, 433820, 433821
Bug Blocks:

Description Marc Schoenefeld 2007-09-21 08:03:53 UTC

OpenOffice.org-base allows to execute arbitrary static public java methods.  
This can be misused by a remote attacker to send a victim a handcrafted odb files.
The odb file execute these commands in the database bootstrap phase.
  
Furthermore an unprivileged user can extend his privileges by using aliased
methods.

Comment 4 Caolan McNamara 2007-10-04 15:36:30 UTC

But is this really OOo, or is it hsqldb. Would sure be a whole lot easier to
remove this foo from hsqldb, let me just talk to the Sun database developers
about this CALL "java" stuff

Comment 5 Caolan McNamara 2007-10-04 15:41:58 UTC

just putting the hsqldb guys on CC this in the interim

Comment 7 Caolan McNamara 2007-10-08 12:11:42 UTC

ok, hsqldb people and the OOo database people have been informed and we all
reckon it's a problem that needs fixing, though we can't quite creating a
definite practical non-DOS exploit. They're working on a mechanism to avoid the
problem, probably to drop the java execution feature for embedded use like in
OOo, I expect to get notice of their desired embargo date and if the fix will
require changes in hsqldb or OOo or both.

Comment 8 Caolan McNamara 2007-10-17 12:49:33 UTC

Upstream OOo will be rolling out their vanilla OOo 2.3.1 with both their
embedded hsqldb upgraded to 1.8.0.9 which contains part of the fix, and changes
from workspace "hsql1808" which contains the OOo side of the fix, so it looks
we'll need to do erratas for both OOo and hsqldb.

Correspondingly I suggest that the embargo date should follow the 2.3.1 schedule
at http://wiki.services.openoffice.org/wiki/OOoRelease231 , i.e. 4th December 2007.

Comment 10 Marc Schoenefeld 2007-12-04 11:53:21 UTC

This bug is now public, see OO-advisory at
http://www.openoffice.org/security/cves/CVE-2007-4575.html

Comment 13 Red Hat Product Security 2008-01-14 17:05:46 UTC

This issue was addressed in:

Red Hat Enterprise Linux:
  http://rhn.redhat.com/errata/RHSA-2007-1048.html
  http://rhn.redhat.com/errata/RHSA-2007-1090.html

Fedora:
  https://admin.fedoraproject.org/updates/F7/FEDORA-2007-4120
  https://admin.fedoraproject.org/updates/F8/FEDORA-2007-4172