An October 5 press release from The
Document Foundation provides a bit of information about a vulnerability
that was fixed in recent versions of LibreOffice (LO). The vulnerability sounds
fairly serious: "This flaw could have been
used for nefarious purposes, such as installing viruses, through a
specially-crafted [.doc] file." It was evidently fixed, silently, in
versions 3.4.3 and 3.3.4 of LO, which were released in August. The details
(such as they are) were withheld "until users
have been given time to migrate to the new version", but it isn't at
all clear that Linux distributions have put out fixes yet. Worse still,
OpenOffice.org (OOo) is vulnerable as well, but there has been no release
from that project since January.
As of this writing, only Debian has released
a security update to address the problem, and that fix is only for
OOo as Debian hasn't had a release that contains LO. Other distributions
may have updated LO (and/or OOo), but just as bug fix releases. They may
have been misled by the release
notes for LO 3.4.3, which makes no mention of security fixes (nor does
the release notes for 3.3.4). Even the
list of fixes appears to be mute about the problem.
Now that the vulnerability has been made public as CVE-2011-2713
(just a placeholder at the moment), one would guess that other
distributions will be releasing updates soon as well. Even if a bug fix update
did pick up the fix, it would make sense for distributions to put
out a security alert so that their users will be more likely to upgrade.
But it's a little puzzling how we got to this point.
The problem was found by Red Hat security researcher Huzaifa Sidhpurwala
and was fixed by Caolan McNamara of
Red Hat and Marc-André Laverdière of Tata Consultancy
Services, according to the press release. That would seem to clearly show
that some folks at Red Hat (at least)
were aware of the problem. In fact, McNamara put out bug fix updates for both OOo
(for F14) and LO (for F15) in September that only mention "Update for
commonly reported crashes" and "Fixes for
commonly reported problems". Was the fix for CVE-2011-2713
included, but just not mentioned?
Press releases are not the usual way that vulnerabilities are announced, at
least in the free software world. The wording of that release certainly
indicates that the project was aware of the security implications of the
fix, but withheld the information in accordance with "industry best
practice". Perhaps the project was waiting until distributions were
able to update their LO packages (albeit silently), but that begs another
question: what about OOo?
One hopes that the press release is not the first time that the OOo
community is hearing about the vulnerability, but that seems to be the case.
When the press release was reported to the Apache OpenOffice (AOO)
development mailing list, Dennis Hamilton indicated that it might be the first notice
that AOO had received.
But Simon Phipps quoted an unnamed LO
developer who claimed to have alerted AOO:
I've investigated and I am informed by one of the LO developers:
> The initial report was sent to email@example.com on
> 25-07-2011, the assigned CVE id was cc'ed there somewhat later on. I
> posted the 5 patches which in combination would fix it to the list as
> well. I was informed an ApacheOOo representative had joined the list.
Evidently, an AOO representative was not added to the mailing
list, though, as Hamilton pointed out:
That information concerning an ApacheOOo representative on
firstname.lastname@example.org is apparently inaccurate. Or
else there is a breakdown in the vulnerability being
communicated to ApacheOOo.
It certainly would have been a nice
gesture—in keeping with "responsible disclosure"—for the LO folks to ensure that AOO was up to speed before
putting out a press release.
As Hamilton put it: "I trust this is the last time that either of our projects learn about
something like this in a press release."
But Hamilton also notes that the release mentions additional fixes:
report refers to "some additional security patches and fixes"
without mention of any CVEs. It would be good to know what
that is about.
It's hard to disagree with that. There is no good reason that LO and AOO
can't work together on security issues, regardless of any other friction
there may be between the two. It's unfortunate that the "securityteam"
mailing list didn't include any AOO folks (one guesses that it does now or will
soon), but there is no reason that AOO should have learned about this
problem via press release.
The LO developer's message would seem to indicate that OOo is
vulnerable, but it's a
little too early to say for sure. It is possible that the problem only
exists in Go-OO-derived builds (which is what Linux distributions typically
shipped prior to LO coming on the scene). If OOo is vulnerable, it's also
unclear what AOO
will be able to do about it. At the moment,
AOO is in a state of flux as it transitions to an Apache incubator
project. There have been no releases of the AOO project and
it may still be a ways off before that can happen.
For Linux users, the problem will likely sort itself out in short order.
Distributions will patch LO and OOo if they haven't already and make them
available to their users. For Windows and Mac OS X users of OOo, though,
the picture is murkier—at least if the vulnerability exists in those
versions. There aren't distribution-like entities for applications on
those platforms and the AOO project is not (yet) in a position to do
security releases. It might be prudent for those users to consider
switching to LO, at least temporarily, until AOO sorts itself out. Being
cautious about opening random .doc files is another alternative,
but that's always been good advice, though it is rarely followed.
In the final analysis, the press release raises more questions than it
actually answers. What was, presumably, an attempt to shed some light on a
security flaw in LO instead muddied the waters considerably. One hopes
that a more transparent security process will come about for LO so that all
of its downstreams—as well as its AOO "sidestream"—are notified of
security problems in a timely way. In fact, both LO and AOO should be
thinking about proper ways to handle and announce security fixes, perhaps
along the lines of what Mozilla does.
It may be "industry standard" to
silently fix security holes, but free software communities can, and should,
do better than that.
to post comments)