bugtraq - CVE-2014-3524: Apache OpenOffice Calc Command Injection Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <53F5EDAC.7000304@apache.org>
Date: Thu, 21 Aug 2014 15:01:32 +0200
From: Herbert Duerr <hdu@...che.org>
To: announce@...noffice.apache.org, dev@...noffice.apache.org,
  users@...noffice.apache.org, full-disclosure@...ts.grok.org.uk,
  bugtraq@...urityfocus.com
CC: zeroday@...textis.co.uk
Subject: CVE-2014-3524: Apache OpenOffice Calc Command Injection Vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

CVE-2014-3524
OpenOffice Calc Command Injection Vulnerability

Severity: Important
Vendor: The Apache Software Foundation

Versions Affected:
	Apache OpenOffice 4.1.0 and older on Windows.
	OpenOffice.org versions may also be affected.

Description:
	The vulnerability allows command injection when loading Calc spreadsheets. Specially crafted documents can be used for command-injection attacks. Further exploits are possible but have not been verified.

Mitigation:
        Apache OpenOffice users are advised to upgrade to Apache OpenOffice 4.1.1. Users who are unable to upgrade immediately should be cautious when opening untrusted documents.

Credits:
	The Apache OpenOffice security team credits Rohan Durve and James Kettle of Context Information Security as the discoverer of this flaw.

Herbert Dürr
Member of the Apache OpenOffice Security Team
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (Cygwin)

iQIcBAEBAgAGBQJT9e2fAAoJEDfnuKc+PLjJNT0P/1kg+qHwcuqDScV2HdOHbIP3
409ABpECFSLsAf4S6EwpBTeSBQoBCco+uyzMPJ9yOO6xcDdcuq2BF6vdBLL46UKC
WP+yy4G4BBAX/NnE+mTVT2Tc+JgwJJ6Zzd03JuIQo4T0qnsnYjfG7fAY9fx4vTc5
TAvFEakG8Nrrvoq5s856aKZdRlM5JMsUPzFd1JtsWopWmyRWHd9dNwJZJAmTr68F
3QeBONe9SKK1nb9TxQt5W4MUbraw6doN6q5bDa8eDJUiwzGraMqdCBTD2tVe09BF
Mi2TM6lJc4D27aZ8vMxZJTMWRGNGSU9fAuZYNmndXCYGk3rjKB6ghEfxK2DjaG5b
KuXAg6jg8Q+9CZNL769h1NIavj+Yhs7ouiFgS5gkb0l8oeU/UiCcmqq5y0cTzT43
Bu/5VYLj4dNq2XwwMLY7lzQeJ4xKS8WLmBEJ43v3Pocha5f020dftgH0D+sV3V8C
7Rn33gPrf5Ff/klGcvEUOkCRRalKI72CAN7c8AkPlNwWb4OhIQboSNRHF1jHm8Kb
mifIsECKudk8cKbKkiRuP9Eaq+nfZp/WswvmPboRuMdTLuT4vwGUTXzL7If8XDb6
a2a3Mc4Mr5unYVJLG3lS+VkozjQOVjjDwy8FuiZg/To/bsmZ5s+vURwHH8EGkUFN
N3jdeIXCa76iNNKuVPHF
=Ku0Y
-----END PGP SIGNATURE-----