Explore the latest news and trends  

Keep yourself up to date with one of the following options:

  • Explore more news around Spam/Phishing, Malware/Cyber-attacks and Antivirus
  • Receive news and special offers from SPAMfighter directly in you inbox.
  • Get free tips and tricks from our blog and improve your security when surfing the net.
  • Go

Patch Issued To Fix WMF Flaw In OpenOffice.org

A patch has been issued to resolve vulnerability in the OpenOffice.org productivity suite, a problem that security vendor Secunia has rated as "highly critical". The Danish vulnerability tracker has recommended users to deploy the patch or update to version 2.1, which is a month old.

OpenOffice.org on January 2, 2007 released a patch for the Windows, Solaris and Linux versions of the bundle to plug a security gap in processing WMF (Windows Metafile) image files. An attacker could exploit a malformed WMF image to cause a buffer overflow on PCs running OpenOffice that could enable him to add malicious code to remotely gain control of the system.

However, the attack would succeed only if victims opened an infected document, coming with an e-mail for instance. As the user opens the file, it would start installing unauthorized software on the computer, as per an advisory by Red Hat Inc. Red Hat Inc. is a vendor distributing Linux and it supplies several of its products to OpenOffice suite.

OpenOffice.org is a free software bundle including in it a word processor, spreadsheet and a power-point program. Naturally, it is a competitor to Microsoft's Office suite albeit it is not as widely popular.

According to Mark Cox, director of Red Hat's security response team, the problem was first reported in October 2006, but distributors of OpenOffice chose not to issue the patch. These distributing vendors actually work jointly on security matters. So, they decided until OpenOffice.org acknowledged this week the problem as a security issue they would not release the patch.

There has been no discovery of public exploit or even proof-of-concept code so far. Red Hat has rated the vulnerability as only "important" because it requires a user to open a malicious document. Cox said that users will either receive an automatic update or notification to upgrade their application.

The patch is said to remedy the problem in version 1.1.5. An entry in the flaw database shows that version 2.0.4 is affected, too, while version 2.1 no longer has the flaw. Linux distributors are offering updated OpenOffice suites. Red Hat has recommended users to install updated version 1.1.2.

Related article: Patch of RealPlayer Plugs the Wild Security Exploit

ยป SPAMfighter News - 09-01-2007

3 simple steps to update drivers on your Windows PCSlow PC? Optimize your Slow PC with SLOW-PCfighter!Email Cluttered with Spam? Free Spam Filter!

Exchange Anti Spam Filter
Go back to previous page
Next