Security

OpenOffice.org security concerns

Over the past month, there have been various news articles regarding OpenOffice.org (OO.o) security, particularly in comparison with its main closed source rival, MS Office. Some articles have depicted OO.o as vastly less secure based on research by an organization within the French Ministry of Defense. The situation is a lot more muddled than that and unfortunately, because details are hard to come by, it is difficult to fully evaluate the threat.

The original article (in French) described a meeting where a report on OO.o security was shared with various French ministries. The report supposedly claimed that for some threat types, OO.o was more vulnerable than MS Office. Another article, with the provocative title OpenOffice.org less secure than Microsoft Office?, appeared shortly thereafter and fanned the flames, positing that the city of Paris and other OO.o users in France might reconsider their tool choices based on the report.

A 'response' to the articles appeared on the OO.o website but did little to shed any light. It was claimed that it would be inappropriate to respond to a "leak from a private meeting" followed by some platitudes about security response by the OO.o team. Perhaps unsurprisingly, there was no confirmation or denial of the security issues.

Shortly thereafter, Sun's Technical Architect for OO.o, Malte Timmermann, posted some information in his blog. He and the OO.o team in Hamburg spoke with Eric Filiol, one of the authors of the report, to discuss the findings. According to Timmermann, there were three issues, only one of which was truly a bug and even it was "not really a security issue." All of the issues seem to revolve around macros and how they are trusted both by users and by the software itself.

Timmermann followed that up with another blog posting this week that gave a few more details. He claims that the original report (which is to be published in the Journal in Computer Virology) was "conceptual problems only, not about security exploits." The problems described all stem from an initial infection which happens via a user running untrusted code (either as a regular executable or as a macro in an untrusted document).

Timmermann rightly points out that if a user runs code from untrusted sources, changing security settings for OO.o may well be the least of their worries. Untrusted code can do anything that the user running it has permission to do and that has nothing to do with what OS or office suite you happen to be running. It may be that users still need additional training so that they do not run macros from untrusted documents, but OO.o does provide a security warning before executing them. He also points out that both MS Office and OO.o provide a powerful scripting language that has access to the underlying system and that threats from running untrusted macros are likely to be similar for both office suites.

So, depending on who you listen to, there are either some serious (but largely unspecified, at least as of yet) security issues with OO.o, or there are not. OO.o is more at risk for these (again unspecified) risks than MS Office or it is not. There is at least one bug that Timmermann mentions, but it has not yet been fixed (based on the most recent security fix for OO.o which was 29 June, well before this information came to light). It is not clear why there is so much murkiness surrounding these issues. Is it due to 'responsible' disclosure policies? Or are folks unwilling to disclose the most interesting pieces of the journal article before it is published?

Around the time these issues were being discussed, there were a number of 'zero-day' exploits in the wild against various MS Office formats. It seems likely that some of the technical press wanted to present 'balanced' coverage and seized on this issue to offset the negative press about MS Office. From the limited details we have seen so far, this particular report about the security of OO.o would not seem to merit the coverage that it has gotten.

Comments (11 posted)

Rails 1.1.6, backports, and full disclosure

The Ruby on Rails web log mentions an important security update for Rails. "The cat is out of the bag, so here’s the full disclosure edition of the current security vulnerability. With Rails 1.1.0 through 1.1.5 (minus the short-lived 1.1.3), you can trigger the evaluation of Ruby code through the URL because of a bug in the routing code of Rails. This means that you can essentially take down a Rails process by starting something like /script/profiler, as the code will run for a long time and that process will be hung while it happens. Other URLs can even cause data loss. We’ve backported a fix to all the affected versions for those of you that can’t update."

Comments (none posted)

drupal: missing input sanitizing

Package(s):	drupal	CVE #(s):	CVE-2006-4002
Created:	August 10, 2006	Updated:	August 16, 2006
Description:	The Drupal web platform performs insufficient input sanitizing in the user module, this can be used for a cross-site scripting attack.
Alerts:	Debian DSA-1147-1 drupal 2006-08-09

Comments (none posted)

gallery: multiple vulnerabilities

Package(s):	gallery	CVE #(s):	CVE-2005-2734 CVE-2006-0330 CVE-2006-4030
Created:	August 10, 2006	Updated:	August 16, 2006
Description:	gallery, a web-based photo album, has the following remotely exploitable vulnerabilities: A cross-site scripting vulnerability can be used for the injection of web script code through HTML or EXIF information. The user registration code is vulnerable to a cross-site scripting attack involving the injection of web script code. The stats modules has missing input sanitizing, this can lead to information disclosure.
Alerts:	Debian DSA-1148-1 gallery 2006-08-09

Comments (none posted)

heartbeat: out-of-bounds read

Package(s):	heartbeat	CVE #(s):	CVE-2006-3121
Created:	August 15, 2006	Updated:	August 25, 2006
Description:	Yan Rong Ge discovered out-of-boundary memory access in heartbeat, the subsystem for High-Availability Linux. This could be used by a remote attacker to cause a denial of service.
Alerts:	Gentoo 200608-23 heartbeat 2006-08-24 Ubuntu USN-335-1 heartbeat 2006-08-16 Debian DSA-1151-1 heartbeat 2006-08-15

Comments (none posted)

ncompress: buffer underflow

Package(s):	ncompress	CVE #(s):	CVE-2006-1168
Created:	August 10, 2006	Updated:	February 21, 2012
Description:	The ncompress compression utility has a missing boundary check. A local user can use a maliciously created file to cause a a .bss buffer underflow.
Alerts:	Gentoo 201312-02 busybox 2013-12-02 Mandriva MDVSA-2012:129-1 busybox 2012-08-10 Mandriva MDVSA-2012:129 busybox 2012-08-10 Mageia MGASA-2012-0171 busybox 2012-07-19 Scientific Linux SL-busy-20120709 busybox 2012-07-09 Red Hat RHSA-2012:0810-04 busybox 2012-06-20 Scientific Linux SL-busy-20120321 busybox 2012-03-21 Red Hat RHSA-2012:0308-03 busybox 2012-02-21 Gentoo 200610-03 ncompress 2006-10-06 Red Hat RHSA-2006:0663-01 ncompress 2006-09-12 Mandriva MDKSA-2006:140 ncompress 2006-08-09 Debian DSA-1149-1 ncompress 2006-08-10

Comments (none posted)

Ruby on Rails: several vulnerabilities

Package(s):	rails	CVE #(s):
Created:	August 14, 2006	Updated:	August 16, 2006
Description:	The Ruby on Rails developers have corrected some weaknesses in action_controller/, relative to the handling of the user input and the LOAD_PATH variable. A remote attacker could inject arbitrary entries into the LOAD_PATH variable and alter the main Ruby on Rails process. The security hole has only been partly solved in version 1.1.5. Version 1.1.6 now fully corrects it.
Alerts:	Gentoo 200608-20 rails 2006-08-14

Comments (none posted)

squirrelmail: insecure permissions

Package(s):	squirrelmail	CVE #(s):	CVE-2006-4019
Created:	August 14, 2006	Updated:	September 26, 2006
Description:	Squirrelmail contains a vulnerability that allows authenticated users to read and write other users' preferences and attachments.
Alerts:	Red Hat RHSA-2006:0668-01 squirrelmail 2006-09-26 Mandriva MDKSA-2006:147 squirrelmail 2006-08-22 Debian DSA-1154-1 squirrelmail 2006-08-20 Fedora FEDORA-2006-913 squirrelmail 2006-08-15 rPath rPSA-2006-0152-1 squirrelmail 2006-08-11

Comments (none posted)

warzone2100: buffer overflows

Package(s):	warzone2100	CVE #(s):	CVE-2006-3849
Created:	August 11, 2006	Updated:	August 16, 2006
Description:	Luigi Auriemma discovered two buffer overflow vulnerabilities in Warzone 2100 Resurrection. The recvTextMessage function of the Warzone 2100 Resurrection server and the NETrecvFile function of the client use insufficiently sized buffers. A remote attacker could exploit these vulnerabilities by sending specially crafted input to the server, or enticing a user to load a specially crafted file from a malicious server. This may result in the execution of arbitrary code with the permissions of the user running Warzone 2100 Resurrection.
Alerts:	Gentoo 200608-16 warzone2100 2006-08-10

Comments (none posted)

WordPress: privilege escalation

Package(s):	wordpress	CVE #(s):
Created:	August 11, 2006	Updated:	August 16, 2006
Description:	The WordPress developers have confirmed a vulnerability in capability checking for plugins. By exploiting a flaw, a user can circumvent WordPress access restrictions when using plugins. The actual impact depends on the configuration of WordPress and may range from trivial to critical, possibly even the execution of arbitrary PHP code.
Alerts:	Gentoo 200608-19 wordpress 2006-08-10

Comments (none posted)

Bruce Schneier facts

Ever wanted to know more about high-profile security writer Bruce Schneier? A quick visit or two to the Bruce Schneier facts site may be just what you need.

Comments (2 posted)