OpenOffice.org-base allows to execute arbitrary static public java methods. This can be misused by a remote attacker to send a victim a handcrafted odb files. The odb file execute these commands in the database bootstrap phase. Furthermore an unprivileged user can extend his privileges by using aliased methods.
But is this really OOo, or is it hsqldb. Would sure be a whole lot easier to remove this foo from hsqldb, let me just talk to the Sun database developers about this CALL "java" stuff
just putting the hsqldb guys on CC this in the interim
ok, hsqldb people and the OOo database people have been informed and we all reckon it's a problem that needs fixing, though we can't quite creating a definite practical non-DOS exploit. They're working on a mechanism to avoid the problem, probably to drop the java execution feature for embedded use like in OOo, I expect to get notice of their desired embargo date and if the fix will require changes in hsqldb or OOo or both.
Upstream OOo will be rolling out their vanilla OOo 2.3.1 with both their embedded hsqldb upgraded to 1.8.0.9 which contains part of the fix, and changes from workspace "hsql1808" which contains the OOo side of the fix, so it looks we'll need to do erratas for both OOo and hsqldb. Correspondingly I suggest that the embargo date should follow the 2.3.1 schedule at http://wiki.services.openoffice.org/wiki/OOoRelease231 , i.e. 4th December 2007.
This bug is now public, see OO-advisory at http://www.openoffice.org/security/cves/CVE-2007-4575.html
This issue was addressed in: Red Hat Enterprise Linux: http://rhn.redhat.com/errata/RHSA-2007-1048.html http://rhn.redhat.com/errata/RHSA-2007-1090.html Fedora: https://admin.fedoraproject.org/updates/F7/FEDORA-2007-4120 https://admin.fedoraproject.org/updates/F8/FEDORA-2007-4172