{"id":101354,"date":"2021-09-21T10:22:45","date_gmt":"2021-09-21T08:22:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-openoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-fajla"},"modified":"2021-09-21T10:22:45","modified_gmt":"2021-09-21T08:22:45","slug":"uyazvimost-v-openoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-fajla","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-openoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-fajla","title":{"rendered":"Vulnerability in OpenOffice Allows Code Execution When Opening a File","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A vulnerability has been identified in the Apache OpenOffice office suite (CVE-2021-33035) that enables code execution when opening a specially crafted file in DBF format. The researcher who discovered the problem warned of the creation of a working exploit for the Windows platform. A patch for this vulnerability is currently available only in the project's repository, included in the test builds of OpenOffice 4.1.11. Updates for the stable branch have not yet been provided. <\/p>\n
The issue is caused by OpenOffice relying on the fieldLength and fieldType values in the DBF file header when allocating memory, without verifying the actual data type in the fields. To carry out an attack, one can specify the fieldType as INTEGER, but place larger data and set the fieldLength to a value that does not match the size of the data with the INTEGER type, which will result in the tail of the data from the field being written beyond the allocated buffer. As a result of this controlled buffer overflow, the researcher was able to overwrite the return pointer from the function and use return-oriented programming (ROP) techniques to execute their code. <\/p>\n
In using ROP techniques, the attacker does not attempt to place their code in memory but instead operates using existing pieces of machine instructions in the loaded libraries that end with a return instruction (usually the ends of library functions). The exploit's operation consists of constructing a chain of calls to these blocks (\"gadgets\") to achieve the desired functionality. As gadgets in the exploit for OpenOffice, code from the libxml2 library used in OpenOffice was employed, which, unlike OpenOffice itself, had been compiled without DEP (Data Execution Prevention) and ASLR (Address Space Layout Randomization) protection mechanisms. <\/p>\n
The developers of OpenOffice were notified of the issue on May 4, after which a public disclosure of the vulnerability was scheduled for August 30. Since the stable branch update had not been formed by the due date, the researcher postponed the details disclosure to September 18, but the OpenOffice developers had not managed to prepare the 4.1.11 release by that time. Notably, during the same research, a similar vulnerability in the DBF format support code in Microsoft Office Access (CVE-2021\u201338646) was identified, details of which will be disclosed later. No issues were found in LibreOffice. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"