Summary
The host has OpenOffice installed which is prone to heap based buffer overflow vulnerability.
Impact
Exploitation will result in buffer overflows via a specially crafted document and allow remote unprivileged user who provides a OpenOffice.org document that is opened by a local user to execute arbitrary commands on the system with the privileges of the user running OpenOffice.org.
Impact Level : System
Solution
Upgrade to OpenOffice 2.4.1
http://download.openoffice.org/index.html
Insight
The flaw is in alloc_global.c file in which rtl_allocateMemory function rounding up allocation requests to be aligned on a 8 byte boundary without checking the rounding results in an integer overflow condition.
Affected
OpenOffice.org 2.x on Linux (Any).
References
Severity
Classification
-
CVE CVE-2008-2152 -
CVSS Base Score: 9.3
AV:N/AC:M/Au:N/C:C/I:C/A:C
Related Vulnerabilities
- ChaSen Buffer Overflow Vulnerability (Windows)
- Adobe Flash Player Multiple Vulnerabilities - Mar09 (Win)
- Citrix Provisioning Services 'streamprocess.exe' Component Remote Code Execution Vulnerability
- Adobe Reader/Acrobat Multiple BOF Vulnerabilities - Jun09 (Win)
- Adobe Reader 'XFDF' File Buffer Overflow Vulnerability (Linux)