Red Hat Bugzilla – Bug 299801
CVE-2007-4575 OpenOffice.org-base allows Denial-of-Service and command injection
Last modified: 2008-02-21 11:16:38 EST
OpenOffice.org-base allows to execute arbitrary static public java methods.
This can be misused by a remote attacker to send a victim a handcrafted odb files.
The odb file execute these commands in the database bootstrap phase.
Furthermore an unprivileged user can extend his privileges by using aliased
But is this really OOo, or is it hsqldb. Would sure be a whole lot easier to
remove this foo from hsqldb, let me just talk to the Sun database developers
about this CALL "java" stuff
just putting the hsqldb guys on CC this in the interim
ok, hsqldb people and the OOo database people have been informed and we all
reckon it's a problem that needs fixing, though we can't quite creating a
definite practical non-DOS exploit. They're working on a mechanism to avoid the
problem, probably to drop the java execution feature for embedded use like in
OOo, I expect to get notice of their desired embargo date and if the fix will
require changes in hsqldb or OOo or both.
Upstream OOo will be rolling out their vanilla OOo 2.3.1 with both their
embedded hsqldb upgraded to 18.104.22.168 which contains part of the fix, and changes
from workspace "hsql1808" which contains the OOo side of the fix, so it looks
we'll need to do erratas for both OOo and hsqldb.
Correspondingly I suggest that the embargo date should follow the 2.3.1 schedule
at http://wiki.services.openoffice.org/wiki/OOoRelease231 , i.e. 4th December 2007.
This bug is now public, see OO-advisory at
This issue was addressed in:
Red Hat Enterprise Linux: