Product
StarOffice 8 Software

Bug Id
6520258

Date of Workaround Release
10-APR-2007

Date of Resolved Release
17-MAY-2007

Impact

Due to a security vulnerability in StarOffice/StarSuite 8, manipulated WordPerfect files, which may have been provided by a local or remote untrusted user, may lead to heap overflow and arbitrary code execution.

This issue is described in the following documents:

• CVE-2007-0002 at: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0002
• iDefense Public Advisory at: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=490 

Contributing Factors

This issue can occur in the following releases:

SPARC Platform

• StarOffice 8 without patch 120185-10
• StarSuite 8 without patch 120189-10

x86 Platform

• StarOffice 8 without patch 120186-10
• StarSuite 8 without patch 120190-10

Linux Platform

• StarOffice 8 without patch 120184-09
• StarSuite 8 without patch 120188-09

Windows Platform

• StarOffice 8 without patch 120187-09
• StarSuite 8 without patch 120191-09

Note: StarOffice/StarSuite versions 6.0 and 7 are not impacted by this issue.

To determine the version of StarOffice installed on a system, the following command can be run (for /<staroffice program dir>/program/bootstraprc):

    % cat bootstraprc | grep Product
ProductKey=StarOffice 8
    ProductPatch=(Product Update 2)

On the Windows platform, using the GUI, do the following (with StarOffice/StarSuite open):

1. Open the "Help" menu
2. Choose "About StarOffice" (StarSuite)

The version is displayed first in the "about" text.

Symptoms

There are no predictable symptoms that would indicate the described issue has occurred.

Workaround

To work around the described issue, only load WordPerfect files from known sources.

Resolution

This issue is addressed in the following releases:

SPARC Platform

• StarOffice 8 with patch 120185-10 or later
• StarSuite 8 with patch 120189-10 or later

x86 Platform

• StarOffice 8 with patch 120186-10 or later
• StarSuite 8 with patch 120190-10 or later

Linux Platform

• StarOffice 8 with patch 120184-09 or later
• StarSuite 8 with patch 120188-09 or later

Windows Platform

• StarOffice 8 with patch 120187-09 or later
• StarSuite 8 with patch 120191-09 or later

Modification History
Date: 17-MAY-2007

• State: Resolved
• Updated Contributing Factors and Resolution sections

References

120191-09
120189-10
120187-09
120185-10
120188-09
120184-09
120186-10
120190-10




Attachments

This solution has no attachment