The odd saga of CVE-2012-5639 [LWN.net]

The odd saga of CVE-2012-5639

Posted Jan 10, 2024 10:57 UTC (Wed) by smurf (subscriber, #17840)
In reply to: The odd saga of CVE-2012-5639 by NYKevin
Parent article: The odd saga of CVE-2012-5639

> So it's difficult to argue that this is not a desirable feature for a document-sharing application

LibreOffice is *not* a "document-sharing application". It's an application to work with documents. On, you know, your computer, which may or may not be connected to the network in the first place. Any sharing you do happens outside of LO, because of reasons.

I want my office programs to not even think of talking to the network unless specifically directed to do so. I also want them to save documents locally instead of fetching bits and pieces (which might vanish at any time) from somewhere else.

There are enough situations where moral or legal requirements compel you to save an immutable copy of a document. How does that even work when part of the document gets loaded from a random place on the net?

LibreOffice is an office suite. It's not a browser.

to post comments

The odd saga of CVE-2012-5639

Posted Jan 10, 2024 13:15 UTC (Wed) by pizza (subscriber, #46) [Link]

> I want my office programs to not even think of talking to the network unless specifically directed to do so. I also want them to save documents locally instead of fetching bits and pieces (which might vanish at any time) from somewhere else.

For most corporate deployments of office programs, "talking to the network" is a mandatory feature that is routinely used. Heck, I'd argue that this is probably also routine in personal settings as well.

This "problem" seems to be an example of "there is no objectively correct default" for all user types.

(Personally I'd be in favor of "block remote resources by default with a warning bar across the top", with a pop-up UI to view the hostnames/etc as well as the allow/deny lists, as there's already other LO precedent for that sort of thing. But I also recognize that 98.3711% of the time the answer will be "allow, of course" leading to muscle memory allowing malicious content through)

The odd saga of CVE-2012-5639

Posted Jan 10, 2024 18:57 UTC (Wed) by rgmoore (✭ supporter ✭, #75) [Link] (6 responses)

I want my office programs to not even think of talking to the network unless specifically directed to do so. I also want them to save documents locally instead of fetching bits and pieces (which might vanish at any time) from somewhere else.

That's great, but you aren't the only person who uses office programs, and you don't get to tell everyone else they're using them wrong. There are all kinds of useful use cases for accessing other files from within yours. An obvious one is embedding one office document in another: a spreadsheet in a word processor document, a flow chart in a presentation, etc. It can be very useful if, for example, I can change information in one location and have it automatically update everywhere.

There are also a whole lot of uses for external data sources specifically in spreadsheets. They let ordinary users who don't think of themselves as programmers do things like access and process information from a company database. This is a big use case for companies, and any spreadsheet that wants a second look from business users needs to support it. From the LibreOffice website:

Advanced DataPilot technology makes it easy to pull in raw data from corporate databases, and then cross-tabulate, summarise, and convert it into meaningful information. Real-time data streams can now be integrated in sheets and reports, and factored in calculations.

The odd saga of CVE-2012-5639

Posted Jan 11, 2024 9:23 UTC (Thu) by smurf (subscriber, #17840) [Link] (5 responses)

> you don't get to tell everyone else they're using them wrong.
> There are all kinds of useful use cases for accessing other files from within yours.

So you put the linked-to file in question onto a file server and link to it relative to the source. Or you embed it and offer a "refresh" button. Or you ASK THE USER whether to load external content when they load the document. (Maybe offer an option to cache that decision, per link destination.)

What you DO NOT do is to blindly access random external resources just because somebody sent you a file. That's not "telling people they use LibreOffice wrong", that's "asking the LO developers to please not default to shoddy security practices".

It'd be very nice if we lived in a world where loading random office document content from random sources isn't unsafe. Unfortunately we don't, and as long as security agencies are hoarding exploits instead of getting them fixed (among other reasons) we won't get there any time soon.

The odd saga of CVE-2012-5639

Posted Jan 11, 2024 12:38 UTC (Thu) by Wol (subscriber, #4433) [Link] (3 responses)

It's all very well saying peoples' jobs rely on them opening random documents that may access external content.

But that can be read two ways, either they need the document to access said external content in order to do their job, OR allowing the document to access said external content will cost them their job.

Seeing as I work in an industry (supermarkets) where I have access to a LOT of sensitive information (and no I have neither the desire, NOR the knowledge, to be able to access most of it) that latter case could easily cost not only me, but many of my colleagues, their job.

I've already had to deal with a case recently that could have been extremely serious (as in existential serious) for my employer. I merely dealt with the fallout from someone else's mistake. I'd hate for someone to have to deal with the fallout from me making a mistake like that.

Cheers,
Wol

The odd saga of CVE-2012-5639

Posted Jan 11, 2024 13:49 UTC (Thu) by farnz (subscriber, #17727) [Link] (2 responses)

It's also extremely unusual for someone's job to rely on opening documents that access arbitrary external content. More commonly, if you need to access external content, it comes from a limited set of sources; for example, you might need to access content stored on your company's managed systems, but not arbitrary Internet content. This implies that, assuming you have a competent and well-run IT department, an allowlist of sources of external content, where sources not on the allowlist are blocked completely, would be sufficient to protect users and wouldn't affect people's ability to do their jobs.

Of course, as with anything else, the hard part is making sure that the assumption is true. It's all too common for IT departments to be a mixture of incompetent and badly run, such that there's no way to handle exceptional cases or change to the norm in a speedy but safe fashion.

The odd saga of CVE-2012-5639

Posted Jan 11, 2024 14:10 UTC (Thu) by smurf (subscriber, #17840) [Link] (1 responses)

Personally I could care less about badly-run IT departments. I care about "default-secure", which (a) doesn't even need an IT department and (b) negates quite a few opportunities for incompetence.

On the other hand, a "run in secure mode" button that's hidden three layers deep in some option dialog, defaults to Off, and doesn't allow for a whitelist, is (in some sense) even worse than not having the option at all.

The odd saga of CVE-2012-5639

Posted Jan 12, 2024 2:37 UTC (Fri) by NYKevin (subscriber, #129325) [Link]

> Personally I could care less about badly-run IT departments. I care about "default-secure", which (a) doesn't even need an IT department and (b) negates quite a few opportunities for incompetence.

The problem is that there's no obvious attack which can meaningfully be carried out against a user who doesn't work for some organization with an IT department,* but would be prevented by blocking external content. Sure, there are tracking pixels, but think about it: From the user's perspective, what is the negative consequence caused by a tracking pixel? The sender gets a read receipt? That's hardly worth discussing, by the time you have convinced a user to download and open an attachment. Heck, you could just put the document on your own server and tell the user to click a link to download it, then you don't even need the user to open the document. Do you really think the average non-technical user is going to notice the difference between clicking a link to download something and downloading an attachment?

* The military, the NSA, etc. are all assumed to have IT departments, so we need not concern ourselves with the "my workstation is airgapped and all the ports are filled with epoxy" stuff. Even so, that seems like a problem that solves itself ("airgapped" means no external content will load).

The odd saga of CVE-2012-5639

Posted Jan 19, 2024 4:01 UTC (Fri) by paulj (subscriber, #341) [Link]

File servers have kind of disappeared. Gdrive / Drivebox kind of web-based file storage is the common thing now.