An odd vulnerability report for LibreOffice

An October 5 press release from The Document Foundation provides a bit of information about a vulnerability that was fixed in recent versions of LibreOffice (LO). The vulnerability sounds fairly serious: "This flaw could have been used for nefarious purposes, such as installing viruses, through a specially-crafted [.doc] file." It was evidently fixed, silently, in versions 3.4.3 and 3.3.4 of LO, which were released in August. The details (such as they are) were withheld "until users have been given time to migrate to the new version", but it isn't at all clear that Linux distributions have put out fixes yet. Worse still, OpenOffice.org (OOo) is vulnerable as well, but there has been no release from that project since January.

As of this writing, only Debian has released a security update to address the problem, and that fix is only for OOo as Debian hasn't had a release that contains LO. Other distributions may have updated LO (and/or OOo), but just as bug fix releases. They may have been misled by the release notes for LO 3.4.3, which makes no mention of security fixes (nor does the release notes for 3.3.4). Even the detailed list of fixes appears to be mute about the problem.

Now that the vulnerability has been made public as CVE-2011-2713 (just a placeholder at the moment), one would guess that other distributions will be releasing updates soon as well. Even if a bug fix update did pick up the fix, it would make sense for distributions to put out a security alert so that their users will be more likely to upgrade. But it's a little puzzling how we got to this point.

The problem was found by Red Hat security researcher Huzaifa Sidhpurwala and was fixed by Caolan McNamara of Red Hat and Marc-André Laverdière of Tata Consultancy Services, according to the press release. That would seem to clearly show that some folks at Red Hat (at least) were aware of the problem. In fact, McNamara put out bug fix updates for both OOo (for F14) and LO (for F15) in September that only mention "Update for commonly reported crashes" and "Fixes for commonly reported problems". Was the fix for CVE-2011-2713 included, but just not mentioned?

Press releases are not the usual way that vulnerabilities are announced, at least in the free software world. The wording of that release certainly indicates that the project was aware of the security implications of the fix, but withheld the information in accordance with "industry best practice". Perhaps the project was waiting until distributions were able to update their LO packages (albeit silently), but that begs another question: what about OOo?

One hopes that the press release is not the first time that the OOo community is hearing about the vulnerability, but that seems to be the case. When the press release was reported to the Apache OpenOffice (AOO) development mailing list, Dennis Hamilton indicated that it might be the first notice that AOO had received. But Simon Phipps quoted an unnamed LO developer who claimed to have alerted AOO:

Evidently, an AOO representative was not added to the mailing list, though, as Hamilton pointed out:

It certainly would have been a nice gesture—in keeping with "responsible disclosure"—for the LO folks to ensure that AOO was up to speed before putting out a press release. As Hamilton put it: "I trust this is the last time that either of our projects learn about something like this in a press release."

But Hamilton also notes that the release mentions additional fixes:

It's hard to disagree with that. There is no good reason that LO and AOO can't work together on security issues, regardless of any other friction there may be between the two. It's unfortunate that the "securityteam" mailing list didn't include any AOO folks (one guesses that it does now or will soon), but there is no reason that AOO should have learned about this problem via press release.

The LO developer's message would seem to indicate that OOo is vulnerable, but it's a little too early to say for sure. It is possible that the problem only exists in Go-OO-derived builds (which is what Linux distributions typically shipped prior to LO coming on the scene). If OOo is vulnerable, it's also unclear what AOO will be able to do about it. At the moment, AOO is in a state of flux as it transitions to an Apache incubator project. There have been no releases of the AOO project and it may still be a ways off before that can happen.

For Linux users, the problem will likely sort itself out in short order. Distributions will patch LO and OOo if they haven't already and make them available to their users. For Windows and Mac OS X users of OOo, though, the picture is murkier—at least if the vulnerability exists in those versions. There aren't distribution-like entities for applications on those platforms and the AOO project is not (yet) in a position to do security releases. It might be prudent for those users to consider switching to LO, at least temporarily, until AOO sorts itself out. Being cautious about opening random .doc files is another alternative, but that's always been good advice, though it is rarely followed.

In the final analysis, the press release raises more questions than it actually answers. What was, presumably, an attempt to shed some light on a security flaw in LO instead muddied the waters considerably. One hopes that a more transparent security process will come about for LO so that all of its downstreams—as well as its AOO "sidestream"—are notified of security problems in a timely way. In fact, both LO and AOO should be thinking about proper ways to handle and announce security fixes, perhaps along the lines of what Mozilla does. It may be "industry standard" to silently fix security holes, but free software communities can, and should, do better than that.