Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 13 Dec 2012 17:24:33 -0700
From: Kurt Seifried <>
To: Daniel Kahn Gillmor <>
CC:, Timo Warns <Warns@...-Sense.DE>
Subject: Re: Remote file inclusion by office applications

Hash: SHA1

On 12/13/2012 11:53 AM, Daniel Kahn Gillmor wrote:
> On 12/13/2012 11:44 AM, Kurt Seifried wrote:
>> I'm kind of leaning towards classifying this as a security issue
>> since I expected there is some way to disable it or at least tell
>> it to prompt me when a document tries to go get an external data
>> source (e.g. "this document contains external data, the URLs/file
>> paths it is trying to  reference are: [list of locations]") but
>> apparently there is no way to disable/have this prompt (at least
>> that I can find in LibreOffice)?
> I think your assessment is correct.  I've just now made an ODT file
> that libreoffice uses to not only hit the network for a PNG (denial
> of service attacks, remote exploitation of other flaws in libpng or
> in LO itself, virus scanner bypass, etc), but one that will include
> and render ~/.ssh/id_rsa as a text/plain document.  This seems like
> it could be done against any local privileged file.
> For local file inclusion, libreoffice at leasts prompts me with:
> ----------- This document contains one or more links to external
> data.
> Would you like to change the document, and update all links to get
> the most recent data?
> [Yes] [No] -----------
> but it doesn't tell me what those documents are. And given the UI 
> history of people clicking through popups they don't understand,
> i'm not convinced that this popup is going to do anything to
> prevent remote disclosure (it even defaults to "Yes").  When i say
> "no" on the prompt, it goes out and fetches networked URLs anyway,
> so i assume this prompt is supposed to just refer to local
> "external data".
> --dkg

Ok so for LibreOffice and OpenOffice please use CVE-2012-5639 for this
issue (automatic opening of remote content/poor UI so you have no idea
what it is your opening).

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

Version: GnuPG v1.4.12 (GNU/Linux)


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.