Note: This is an archival copy of Security Sun Alert 200865 as previously published on http://sunsolve.sun.com. Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1000655.1. |
Category Security Release Phase Resolved StarOffice 7 Software StarOffice 6.0 Office Suite StarOffice 8 Software Bug Id 6556877 Date of Resolved Release 15-JUN-2007 Impact A security vulnerability with the way StarOffice/StarSuite 6, 7 and 8 process Rich Text Format (RTF) documents may allow a remote unprivileged user who provides a StarOffice/StarSuite RTF document that is opened by a local user the ability to execute arbitrary commands on the system with the privileges of the user running StarOffice/StarSuite. Sun acknowleges with thanks, John Heasman from NGS Software Ltd (www.ngssoftware.com) for bringing this issue to our attention. This issue is referenced in the following document: CVE-2007-0245 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=2007-0245 Contributing Factors This issue can occur in the following releases: SPARC Platform
x86 Platform
Linux Platform
Windows Platform
Note: StarOffice/StarSuite earlier versions will not be evaluated regarding this issue. To determine the version of StarOffice/StarSuite installed on a system, the following command can be run (for /<program dir>/program/bootstraprc): % grep Product bootstraprc ProductKey=StarOffice 8 ProductPatch=(Product Update 5) Or using the GUI, do the following (with StarOffice/StarSuite open):
The version is displayed first in the "about" text. Symptoms There are no predictable symptoms that would indicate this issue has occurred. Workaround There is no workaround for this issue. Please see the Resolution section below. Resolution This issue is addressed in the following releases: SPARC Platform
x86 Platform
Linux Platform
Windows Platform
References116519-14117073-12 116518-14 116520-13 112885-08 120185-11 120189-11 112886-08 120186-11 120190-11 112887-08 120184-10 120188-10 112888-08 120187-10 120191-10 Attachments This solution has no attachment |
|