Bug 299801 - (CVE-2007-4575) CVE-2007-4575 OpenOffice.org-base allows Denial-of-Service and command injection
CVE-2007-4575 OpenOffice.org-base allows Denial-of-Service and command injection
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20071204,repor...
: Security
Depends On: 303571 303601 303611 318471 318491 318501 318511 433820 433821
Blocks:
  Show dependency treegraph
 
Reported: 2007-09-21 04:03 EDT by Marc Schoenefeld
Modified: 2008-02-21 11:16 EST (History)
7 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-01-14 12:05:46 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Marc Schoenefeld 2007-09-21 04:03:53 EDT
OpenOffice.org-base allows to execute arbitrary static public java methods.  
This can be misused by a remote attacker to send a victim a handcrafted odb files.
The odb file execute these commands in the database bootstrap phase.
  
Furthermore an unprivileged user can extend his privileges by using aliased
methods.
Comment 4 Caolan McNamara 2007-10-04 11:36:30 EDT
But is this really OOo, or is it hsqldb. Would sure be a whole lot easier to
remove this foo from hsqldb, let me just talk to the Sun database developers
about this CALL "java" stuff
Comment 5 Caolan McNamara 2007-10-04 11:41:58 EDT
just putting the hsqldb guys on CC this in the interim
Comment 7 Caolan McNamara 2007-10-08 08:11:42 EDT
ok, hsqldb people and the OOo database people have been informed and we all
reckon it's a problem that needs fixing, though we can't quite creating a
definite practical non-DOS exploit. They're working on a mechanism to avoid the
problem, probably to drop the java execution feature for embedded use like in
OOo, I expect to get notice of their desired embargo date and if the fix will
require changes in hsqldb or OOo or both.
Comment 8 Caolan McNamara 2007-10-17 08:49:33 EDT
Upstream OOo will be rolling out their vanilla OOo 2.3.1 with both their
embedded hsqldb upgraded to 1.8.0.9 which contains part of the fix, and changes
from workspace "hsql1808" which contains the OOo side of the fix, so it looks
we'll need to do erratas for both OOo and hsqldb.

Correspondingly I suggest that the embargo date should follow the 2.3.1 schedule
at http://wiki.services.openoffice.org/wiki/OOoRelease231 , i.e. 4th December 2007.
Comment 10 Marc Schoenefeld 2007-12-04 06:53:21 EST
This bug is now public, see OO-advisory at
http://www.openoffice.org/security/cves/CVE-2007-4575.html

Note You need to log in before you can comment on or make changes to this bug.