Bug 826077 (CVE-2012-2665)

Summary: CVE-2012-2665 openoffice.org, libreoffice: Multiple heap-based buffer overflows in the XML manifest encryption handling code
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: caolanm, mjc, mstahl, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=important,public=20120801,reported=20120528,source=upstream,cvss2=6.8/AV:N/AC:M/Au:N/C:P/I:P/A:P,rhel-5/openoffice.org=affected,rhel-6/libreoffice=affected,fedora-all/libreoffice=affected,cwe=CWE-122[auto]
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-08-24 12:04:37 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 839864, 839866, 839867, 839868, 845119    
Bug Blocks: 826125    
Attachments:
Description Flags
Proposed patches from Caolan McNamara for all three issues none

Description Jan Lieskovsky 2012-05-29 10:30:28 EDT
Multiple heap-based buffer overflow flaws were found in the XML manifest encryption handling code of OpenOffice.org and LibreOffice:

1) Previously it was not checked if the particular tag was contained within expected parent tag, leading to possibility of child tag handler being able to write its data into different (than expected) parent handler sequence, leading to heap buffer overflow,

2) also a fixed size sequence was allocated to record properties of a particular XML tag, associated with XML element. By duplicating certain tags in XML manifest it was possible to write past the heap-based buffer bounds,

3) yet, the Base64 decoder implementation incorrectly assumed the length of ChecksumAttribute (input buffer) to be evenly divisible by 4, leading into the storage for output (Base64 decoded) buffer to be underallocated, resulting into heap buffer overflow.

A remote attacker could provide a specially-crafted Open Document Text (.odt) file, that when opened would cause OpenOffice.org / LibreOffice to crash or, potentially execute arbitrary code with the privileges of the user running a tool from the suite.
Comment 4 Jan Lieskovsky 2012-05-29 10:45:37 EDT
This issue affects the versions of the openoffice.org package, as shipped
with Red Hat Enterprise Linux 5 and 6.

--

This issue affects the versions of the libreoffice package, as shipped with Fedora release of 15 and 16.
Comment 6 Jan Lieskovsky 2012-06-01 11:10:56 EDT
Created attachment 588505 [details]
Proposed patches from Caolan McNamara for all three issues
Comment 7 Jan Lieskovsky 2012-06-01 12:07:30 EDT
The CVE identifier of CVE-2012-2665 has been assigned to this issue.
Comment 9 Jan Lieskovsky 2012-07-03 12:29:43 EDT
Acknowledgements:

Upstream acknowledges Timo Warns as the original reporter of this issue.
Comment 13 Vincent Danen 2012-08-01 11:09:08 EDT
External References:

http://www.libreoffice.org/advisories/CVE-2012-2665/
Comment 14 errata-xmlrpc 2012-08-01 15:35:58 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2012:1136 https://rhn.redhat.com/errata/RHSA-2012-1136.html
Comment 15 errata-xmlrpc 2012-08-01 15:46:24 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:1135 https://rhn.redhat.com/errata/RHSA-2012-1135.html
Comment 16 Vincent Danen 2012-08-01 16:26:42 EDT
Created libreoffice tracking bugs for this issue

Affects: fedora-all [bug 845119]
Comment 17 Fedora Update System 2012-08-10 18:37:02 EDT
libreoffice-3.4.5.2-18.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.