Security Patch for OpenOffice

← Back to Stories (view on slashdot.org)

Security Patch for OpenOffice

Posted by Zonk on Friday April 15, 2005 @04:49AM from the keep-the-uninvited-guests-out dept.

An anonymous reader writes "Linuxlookup.com is reporting all users of OpenOffice.org 1.1.4 are urged to download and install this security patch. It addresses a problem noted in a recent advisory. That advisory states that there is a security risk in all circulating releases of OpenOffice.org. This patch fixes the problem in 1.1.4 but not in earlier or subsequent releases."

19 comments

Min score:

Reason:

Sort:

This just goes to show... by bcmm · 2005-04-15 04:53 · Score: 2, Funny

That you should use secure software like MS Word.

Oh, wait...

--
# cat /dev/mem | strings | grep -i llama
Damn, my RAM is full of llamas.
1. Re:This just goes to show... by youknowmewell · 2005-04-15 05:02 · Score: 0, Troll
  
  In Korea, only old people use MS Word!
  In Soviet Russia, old people you YOU!
  
  1. Get use by old people.
  
  2. ???
  
  3. Profit!
not _that_ serious.. by gl4ss · 2005-04-15 05:00 · Score: 1

but well, someone might get to you through it.

"II.DETAILS:
----------
There is a vulnerability in StgCompObjStream::Load() function,
When reading DOC document information of format,memory is allocated by DOC provide
length.
DOC provided a 32 bits integer,and will use the low 16 bits of this number to allocate
memory,
but when reading doc information,still use the 32 bits number as length,this maybe
cause heap
overflow, and when free happened ,will cause write pointer,maybe cause arbitrary code
excute ."

No idea if it's actually doable to execute code through it on 'all' platforms oo runs on.

--
world was created 5 seconds before this post as it is.
ITS ABOUT TIME by Naikrovek · 2005-04-15 05:00 · Score: 1

this hole was found like ... oh yeah only like a day ago. well that's pretty good i guess.
1. Re:ITS ABOUT TIME by NanoGator · 2005-04-15 05:27 · Score: 2, Insightful
  
  "this hole was found like ... oh yeah only like a day ago. well that's pretty good i guess."
  
  Heh. 'Good' is relative to who you like or dislike. If this story was about Office, it would be 'bad' that the problem existed at all.
  
  --
  "Derp de derp."
2. Re:ITS ABOUT TIME by Curtman · 2005-04-15 06:14 · Score: 1
  
  this hole was found like ... oh yeah only like a day ago.
  
  No, it was found 3 days ago.. Gentoo had the patch and a new ebuild that day.
3. Re:ITS ABOUT TIME by cs02rm0 · 2005-04-15 06:59 · Score: 1
  
  Ah... I was wondering why I had to download and compile OOo twice in two days.
  
  Awesome, I had the patch before this hit slashdot the first time round.
4. Re:ITS ABOUT TIME by 4of12 · 2005-04-15 09:46 · Score: 1
  
  If this story was about Office, it would be 'bad' that the problem existed at all.
  
  Yes, it would be bad.
  
  But people are entitled to gripe more loudly about MS Office because they have paid more money for it than for OpenOffice.
  
  When a customer discovers a manufacturing defect in the product they bought from MS there isn't a flurry of refunds forthcoming. Instead, dissatisfied customers might get a free downloadable patch in a while, essentially the same level of redress that OpenOffice.org users got for their defective product.
  
  When you pay more, you expect more.
  
  --
  "Provided by the management for your protection."
5. Re:ITS ABOUT TIME by Curtman · 2005-04-15 09:48 · Score: 1
  
  I was wondering why I had to download and compile OOo twice
  
  You didn't. openoffice-bin-1.1.4-r1 also contained the fix. No need to compile at all.
6. Re:ITS ABOUT TIME by NanoGator · 2005-04-15 10:05 · Score: 1
  
  "But people are entitled to gripe more loudly about MS Office because they have paid more money for it than for OpenOffice."
  
  Somehow I doubt most of the griping here comes from legitimate Office customers. Afterall, I thought everybody ran Linux here. /sarcasm
  
  --
  "Derp de derp."
Patch by Anonymous Coward · 2005-04-15 05:03 · Score: 0

Linuxlookup.com was kinda slow for me, grab the patch here

-- gid
Affects people loading malicious MS Word files. by ianezz · 2005-04-15 05:04 · Score: 1

The advisory on SecurityFocus.
In portage since the 12th by Mad+Merlin · 2005-04-15 05:29 · Score: 1

*openoffice-1.1.4-r1 (12 Apr 2005) 12 Apr 2005; Andreas Proschofsky <suka@gentoo.org> +files/1.1.4/crash-objstream.diff, +openoffice-1.1.4-r1.ebuild: Revision bump for security fix, see bug #88863
Has been in portage (x86 at least) for a few days now, included with 1.1.4-r1.

--
Game! - Where the stick is mightier than the sword!
1. Re:In portage since the 12th by Stevyn · 2005-04-15 12:38 · Score: 1
  
  Which just goes to show you that distributing software through package managers instead spending $300 on a CD every two years leads to better security in practice. Any distro that uses a package manager to automatically check for software upgrades would be a good leg up in preventing outdated software from being exploited.
Great by Svippy · 2005-04-15 06:02 · Score: 0

At least things get updated faster with Linux than Microsoft and it's evil software applications.

Oooh, ain't they evil!

--
Clicked pie.
How about StarOffice? by Jim+Hall · 2005-04-15 06:13 · Score: 1

I'm on the StarOffice 8 beta program ... anyone know if this version is vulnerable on Linux? I assume so, since it's based on an OOo 2.0 beta build.
This just in! by Anonymous Coward · 2005-04-15 08:51 · Score: 0

A patch for OpenOffice.org, 1.1.4, the latest release, is now available. The patch does not work on any earlier or any newer versions.

Disclaimer: Yes, I know there's the 2.0 betas, but then how is this statement funny?
Can someone explain, please... by Jane+Hackworth · 2005-04-15 15:37 · Score: 0, Offtopic

I think I understand the general concept of a buffer overflow, but how does would the malicious input get into my OpenOffice in the first place? I'm using 1.1.0 and I don't want to upgrade to 1.1.4 just so I can patch it. *sulk*