OOo 3.0 - 3.3 (ODF 1.2) Security patch

Major announcements from the Apache mailing lists

OOo 3.0 - 3.3 (ODF 1.2) Security patch

Postby kingfisher » Sun Mar 25, 2012 12:59 pm

I apologise if this has already been published here. A search did not turn it up.

A security patch has been made available for Windows and Mac versions of the software. The thread on the users' list begins with this message which does not render well in my browser at least, so I quote it here:

Please note, this is the official security bulletin, targeted for
security professionals. If you are an OpenOffice.org 3.3 user, and
are able to apply the mentioned patch, then you are encouraged to do
so. If someone else supports or manages your desktop, then please
forward this information to them.

Additional support is available on our Community Forums:

http://user.services.openoffice.org/

And via our ooo-users mailing list:

http://incubator.apache.org/openofficeo ... iling-list

Note: This security patch for OpenOffice.org is made available to
legacy OpenOffice.org users as a service by the Apache OpenOffice
Project Management Committee. The patch is made available under the
Apache License, and due to its importance, we are releasing it outside
of the standard release cycle.

-Rob

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

CVE-2012-0037: OpenOffice.org data leakage vulnerability

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected: OpenOffice.org 3.3 and 3.4 Beta, on all platforms.
Earlier versions may be also affected.

Description: An XML External Entity (XXE) attack is possible in the
above versions of OpenOffice.org. This vulnerability exploits the way
in which external entities are processed in certain XML components of ODF
documents. By crafting an external entity to refer to other local
file system resources, an attacker would be able to inject contents of other
locally- accessible files into the ODF document, without the user's
knowledge or permission. Data leakage then becomes possible when that
document is later distributed to other parties.

Mitigation: OpenOffice.org 3.3.0 and 3.4 beta users should install the
patch at: http://www.openoffice.org/security/cves ... -0037.html

This vulnerability is also fixed in Apache OpenOffice 3.4 dev
snapshots since March 1st, 2012.

Source and Building: Information on obtaining the source code for this
patch, and for porting it or adapting it to OpenOffice.org derivatives
can be found here: http://www.openoffice.org/security/cves ... 37-src.txt

Credit: The Apache OpenOffice project acknowledges and thanks the
discoverer of this issue, Timothy D. Morgan of Virtual Security
Research, LLC.

References: http://security.openoffice.org
Apache OpenOffice 4.1.2 (64 bit) on PCLinuxOS
User avatar
kingfisher
Volunteer
 
Posts: 2109
Joined: Tue Nov 20, 2007 10:53 am

Re: Security patch

Postby Hagar Delest » Sun Mar 25, 2012 9:21 pm

And here is a detailed analysis of the impact from Dennis E. Hamilton on March, 23rd (my emphasis for better readability):
Dennis E. Hamilton wrote:Here is my personal assessment around the CVE-2012-003 that was announced concurrent with a patch release for OpenOffice 3.3.0 today.

First, the vulnerability is related to use of ODF 1.2 document format in a manner that causes information from the user's computer to be covertly accessed and captured inside the document when it is saved. (If it is not saved, there is no harm. If it is saved as ODF 1.0/1.1, there might also be no harm, although this case requires some testing to confirm.)

As was reported, it is relatively easy to craft an ODF 1.2 document that can exercise the exploit when opened by a vulnerable application.

THE EXTENT OF THE VULNERABILITY

LibreOffice reported CVE-2012-0037 today concurrent with the agreed lifting of the embargo.

My understanding is that later (since January) LO 3.4.x releases have the fix as do the LO 3.5.x releases and release candidates. Consult the LibreOffice.org site and blog for details.

All LibreOffice releases preceding those identified as repaired remain vulnerable.

The patched versions of OO.o 3.3.0 and Oracle OO.o-dev 3.4, are free of the vulnerability. The latest (since March 1) Apache OpenOffice developer previews are free of the vulnerability.

All previous OpenOffice.org releases back to OO.o 3.0 presumably have the vulnerability (since that was the start of claimed ODF 1.2 support). Any unpatched recent versions will continue to have the vulnerability until patched or replaced, of course.

OTHER RELEASES/PRODUCTS THAT DO NOT HAVE THE VULNERABILITY

Pre-3.0 versions of OO.o should not have the vulnerability.

Lotus Symphony has never had the vulnerability.

Microsoft Office 2007/2010 ODF support does not have the vulnerability. Microsoft Office converters from ODF to Office (as used with Office 2003, for example) do not have the vulnerability.

I suspect that documents containing the exploit can't pass through Google Docs, but I haven't tested it. I doubt that they are vulnerable though.

Some other supporters of ODF format have indicated that their products do not support the feature of ODF 1.2 format that is the carrier of the exploit. The suppliers of such products should be consulted directly for confirmation.

DOCUMENTS NOT HAVING THE EXPLOIT

Documents saved as ODF 1.0/1.1 should not preserve any exploit. That is a way to scrub suspicious documents and templates so long as any loss of fidelity is tolerable when going down-level and back.

Documents saved as .doc, .rtf, .docx, .xls, .xlsx, .ppt, .pptx, etc., and then brought back from those formats should not contain any exploit. This only works if any loss of fidelity is tolerable of course. Note that it is not necessary to have Microsoft Office. Using the converters that are part of OpenOffice.org, Apache OpenOffice, and LibreOffice is sufficient.

Saved HMTL documents will, likewise, be stripped of any exploit. Saved PDF documents will also be exploit-free so long as the form of PDF that preserves the original ODF document as an "attachment" is not used.

WHO IS VULNERABLE AND WHAT TO DO IF YOU THINK YOU ARE

The exploit requires that you open and use a document or template from an unreliable or unknown source (or that someone you do trust has managed to do this and sent the result to you). The captured material is no use if the resulting saved document is not returned to someone who knows to look for it. In some forms of the exploit, once information is captured, there are no further captures. However, the captured content can be passed on through subsequent revisions and recipients. That is, there may be perpetuation of covertly-captured residue.

Fortunately, the exploit involves a feature that is not required for the correct processing of most ODF documents (which is also why success of the exploit is easily unnoticed). So extinguishing the feature from a document, while heavy handed, rarely does any harm.

If you have any doubt concerning ODF documents in your possession, you can exercise some of the remedies in the previous section, involving saving the document in different formats and then re-opening it form those formats.

If you are unable to patch your system or want to ensure that documents you already have do not carry any exploit, you can also clean up the ODF package using a Zip utility. It is also possible to produce a utility that can automatically scrub most ODF packages of any potentially-suspect content.

- Dennis

Note that a patch seems to be under progress for GNU/Linux users, especially those who have installed the vanilla version (downloaded from the OOo website).
AOO 4.1.4 on Xubuntu 17.10, (Artful Aardvark) and 4.1.3 on Windows 7 (with winPenPack port).
User avatar
Hagar Delest
Moderator
 
Posts: 27654
Joined: Sun Oct 07, 2007 9:07 pm
Location: France

Re: Security patch

Postby floris v » Mon Mar 26, 2012 12:26 am

:crazy: Never saw that. How come I missed this? I'll post about it in the Dutch forum though. Should this be broadcast as an important issue or is it safe in the general Discussions forum?
MS Windows 10 - AOO 4.1.3 - LibreOffice 5.2.3.3
If your problem has been solved or your question has been answered, please edit the first post in this thread and add [Solved] to the title bar.
Nederlandstalig forum
User avatar
floris v
Moderator
 
Posts: 3950
Joined: Wed Nov 28, 2007 1:21 pm
Location: Netherlands

Re: Security patch

Postby Hagar Delest » Mon Mar 26, 2012 8:12 am

You're right, I've made it global.
AOO 4.1.4 on Xubuntu 17.10, (Artful Aardvark) and 4.1.3 on Windows 7 (with winPenPack port).
User avatar
Hagar Delest
Moderator
 
Posts: 27654
Joined: Sun Oct 07, 2007 9:07 pm
Location: France

Re: OOo 3.0 - 3.3 (ODF 1.2) Security patch

Postby Talvi » Sun Apr 01, 2012 2:24 pm

...as the Update feature doesn't work (at present) I assume that the easiest remedy is to: uninstall, clean traces, and reinstall - with latest version - is this right? If so from where do you recommend getting the appropriately patched version from?

How do I know if I am saving files to ODF 1.0/1.1 format? The save dialogue only shows "ODF Spreadsheet" for instance, with an alternative to save as "Spreadsheet 1.0" for instance.

If I know I have ODF 1.0/1.1 files on my machine how can I "scrub" them simply?
OpenOffice 3.3 on Windows 7
Talvi
 
Posts: 59
Joined: Sat Dec 10, 2011 7:25 pm

Re: OOo 3.0 - 3.3 (ODF 1.2) Security patch

Postby Hagar Delest » Sun Apr 01, 2012 4:24 pm

No, read the post, all 3.x versions are affected. Installing the latest version won't help.
The link to the page for the patch is given in the first post.

ODF version is mentioned in Tools>Options>Load Save>General.
ODF 1.0 and 1.1 are not affected.
AOO 4.1.4 on Xubuntu 17.10, (Artful Aardvark) and 4.1.3 on Windows 7 (with winPenPack port).
User avatar
Hagar Delest
Moderator
 
Posts: 27654
Joined: Sun Oct 07, 2007 9:07 pm
Location: France

Re: OOo 3.0 - 3.3 (ODF 1.2) Security patch

Postby Talvi » Mon Apr 02, 2012 9:52 am

Thanks Hagar but ....
1. I had read the post thanks (see 2, 3 and 4 below).
2. My "version" is given as 3.3.0 000330m20 (Build 9567). "Versions" referred to in the post and comments are designated in the form x.x.x so the relevance of the later alphanumeric data is unclear. e.g. it would be inconceivable for a ver 3.3.9 000330m48 to contain the patch.
3. If applying the "patch" is easy/vital I assumed it would be available in the form of a "standard" download that would auto-install/auto-patch. (see 4 below) As a user it is irrelevant to me whether such a download is a full version of OOo or a "patch".
4. I found when I followed the links that (in FF) they only result in some text being displayed: "b7fa39b764e8a0d083d6be8398075147 *CVE-2012-0037-win.zip" That's it. No download. I didn't include this info with my original post as I assumed you folk would already know this.

Thanks for the link to the default saving option. It recommends saving as 1.2(extended) however I remain unclear if this should be changed, or whether files already saved need to be "scrubbed" which I assume means cleaned and not erased.
OpenOffice 3.3 on Windows 7
Talvi
 
Posts: 59
Joined: Sat Dec 10, 2011 7:25 pm

Re: OOo 3.0 - 3.3 (ODF 1.2) Security patch

Postby Hagar Delest » Mon Apr 02, 2012 10:09 am

Sadly, there is no .exe delivered, so you've to open the zip file and apply the fix yourself. I agree, this is not user friendly.
ODF 1.2 is recommended because it's the latest version so the most up to date. But it's also the version that has the problem.

Personally, I don't send files to anyone so I haven't applied the patch. I'm waiting for AOO 3.4 (already using it at home with the dev version and it is already secure).
AOO 4.1.4 on Xubuntu 17.10, (Artful Aardvark) and 4.1.3 on Windows 7 (with winPenPack port).
User avatar
Hagar Delest
Moderator
 
Posts: 27654
Joined: Sun Oct 07, 2007 9:07 pm
Location: France

Re: OOo 3.0 - 3.3 (ODF 1.2) Security patch

Postby PGAGA » Mon Apr 02, 2012 4:03 pm

April 2, 2012

[Apologies to those who read this in an incomplete form - I hit the wrong key and posted early.]

Talvi wrote:2. My "version" is given as 3.3.0 000330m20 (Build 9567). "Versions" referred to in the post and comments are designated in the form x.x.x so the relevance of the later alphanumeric data is unclear. e.g. it would be inconceivable for a ver 3.3.9 000330m48 to contain the patch.


The x.x.x is what is relevant. Since this is a 2012 security announcement, it is not in any builds prior to the 3.4 release schedules in 2012.

Note this is not just a OOo issue, but applies to all programs using the ODF format.

3. If applying the "patch" is easy/vital I assumed it would be available in the form of a "standard" download that would auto-install/auto-patch. (see 4 below) As a user it is irrelevant to me whether such a download is a full version of OOo or a "patch".


Unfortunately, OOo is product which is no longer supported, so neither a full version nor a patch executable will be available unless someone such as myself were to build one (and I am rusty). Incremental patching was part of the commercial support version of OOo, Oracle Open Office, but I do not know if that was included in the code released to Apache.

But single file patching is simple. Hopefully I will turn what follows into a better FAQ.

Download and install muCommander. Once you have it running (and since you are using Win7, you may have to run as administrator), in the left pane, navigate to where your OOo is installed, something like:

C:\Program Files\OpenOffice.org 3\program\

In the right pane go to the folder where you downloaded the ZIP file (direct link below). Click on it to open it.

Now you will see four files on the right. I would suggest renaming unordfmi.dll on the left to unordfmi.dll.bak, then copy unordfmi.dll on the right to the program folder on the left.

4. I found when I followed the links that (in FF) they only result in some text being displayed: "b7fa39b764e8a0d083d6be8398075147 *CVE-2012-0037-win.zip" That's it. No download. I didn't include this info with my original post as I assumed you folk would already know this.


This is the direct link:

http://www.apache.org/dyn/closer.cgi/in ... 37-win.zip

Phil
OpenOffice.org 3.2.x, StarOffice 5.1, 7, 8 - OS X, WinXP, OS/2
StarOffice 7, 8, Oracle Open Office 3.3.1, LibreOffice 3.x.x - OS X, Ubuntu, WinXP
NeoOffice 2.2.6, 3.1.2, 3.2.x 3.3 - OS X
Apache OpenOffice 3.4.x - WinXP, OS X, OS/2
PGAGA
Volunteer
 
Posts: 481
Joined: Sun Dec 07, 2008 10:54 pm

Re: OOo 3.0 - 3.3 (ODF 1.2) Security patch - Confusion

Postby ScooterC » Mon Apr 02, 2012 8:07 pm

First - I was surprised to find that the community forum was still here!

I joined (subscribed) to the new Apache List server (ooo-users@incubator.apache.org) because I thought this forum had been closed and there was no mention of it in any of the emails I read.

Non-subscribers who need help and hand holding should be directed to this community Forum. Where questions & Answers are available to the general public.
One very unhappy gentleman (computer illiterate) ranted something fierce, subject title "I HATE THIS PROGRAM", in regards to Open Office and this Patch. A discussion ensued in regards to the fact that he was not subscribed to the LIST and therefore would not receive the proper instructions to install this patch.
I have since deleted the entire discussion and can't redirect this gentleman. Rob Weir is the List Host, perhaps the in-the-know people could notify him of the situation.

Thanks & Take Care,
Scooter
College Park, MD USA
OOo 2.4.X on Ms Windows XP + MS Windows VISTA
User avatar
ScooterC
 
Posts: 4
Joined: Fri May 30, 2008 6:23 pm
Location: College Park, MD USA

Re: OOo 3.0 - 3.3 (ODF 1.2) Security patch

Postby floris v » Mon Apr 02, 2012 8:23 pm

I saw part of that discussion (you can view it in the archives at markmail) and was struck by the tone of some of the comments. Apart from the topic title the original post was fairly matter of fact and not so bad-mouthed at all - we've seen worse here. Yet some of the regulars, who tend at times to flame the hell out of each other, reacted as if something really bad had been said.
MS Windows 10 - AOO 4.1.3 - LibreOffice 5.2.3.3
If your problem has been solved or your question has been answered, please edit the first post in this thread and add [Solved] to the title bar.
Nederlandstalig forum
User avatar
floris v
Moderator
 
Posts: 3950
Joined: Wed Nov 28, 2007 1:21 pm
Location: Netherlands

Re: OOo 3.0 - 3.3 (ODF 1.2) Security patch

Postby RoryOF » Mon Apr 02, 2012 8:33 pm

An interesting shift is occurring in the Apache OpenOffice world. You may remember that when the migration of this Forum from Oracle to Apache servers was first mooted, the idea was not warmly accepted. Great opposition was expressed by some to the use of a Forum for User support - they thought all this should be done using mailing lists. But now that there are increasing support requests on the mailing lists, in addition to their normal traffic, thinking seems to be moving in favour of the Forum as a support service. We did try to tell them :-)
Apache OpenOffice 4.1.4 on Xubuntu 16.04.03 (mostly 64 bit version) and infrequently on Win2K/XP
14 October 2016 was Pooh's 90th birthday
User avatar
RoryOF
Moderator
 
Posts: 25483
Joined: Sat Jan 31, 2009 9:30 pm
Location: Ireland

Re: OOo 3.0 - 3.3 (ODF 1.2) Security patch

Postby Talvi » Mon Apr 02, 2012 9:31 pm

Thanks Holgar. Amazing Phil !! :super: Thanks :)

Hagar Delest wrote:ODF 1.2 is .. the version that has the problem.

So does the "scrubbing" ref means open/save in any (?) earlier file types?

Hagar Delest wrote:I'm waiting for AOO 3.4
PGAGA wrote:Unfortunately, OOo is product which is no longer supported

Ohhh nooooo! AOO = Apache Open Office? Having just been burned by connecting to the people at Nokia I am worried about my future with OO. Is there one? And is there a simple helicopter summary of what's occuring?

PGAGA wrote:Since this is a 2012 security announcement, it is not in any builds prior to the 3.4 release schedules in 2012.

If it's not in any build prior to 3.4 then as mine is 3.3 ... I'm confused. Is that a typo?

PGAGA wrote:But single file patching is simple. Download and install muCommander.

Great to hear! :) But ... b****r! I've fallen at the first fence ... err from where?

p.s. feedback on FAQ ... imho Phil your instructions re: looking for the files could be briefer? If we're able to install a patch, use OOo, etc, then we must be familiar with File manager etc. As there are different views in File Manager etc wouldn't it be cleaner to just name the folders and files concerned and leave basic navigation/views etc to users?
OpenOffice 3.3 on Windows 7
Talvi
 
Posts: 59
Joined: Sat Dec 10, 2011 7:25 pm

Re: OOo 3.0 - 3.3 (ODF 1.2) Security patch

Postby Hagar Delest » Mon Apr 02, 2012 10:41 pm

Talvi wrote:does the "scrubbing" ref means open/save in any (?) earlier file types?

Sorry I'm not sure I understand. Earlier version of ODF has not the problem. But it's usually better to use the latest version of a format. So fixing the bug is worth doing.

Talvi wrote:AOO = Apache Open Office? [...] I am worried about my future with OO. Is there one?

Yes, AOO is for Apache OpenOffice. The code base is OOo minus intellectual property cleaning to make it compatible with the Apache license. So don't worry, The continuation of OOo is AOO. You can try the dev version is you want (you can install it in parallel with the regular OOo version), you'll see that there is no visible change.

Talvi wrote:If it's not in any build prior to 3.4 then as mine is 3.3 ... I'm confused. Is that a typo?

PGAGA is talking about the fix, that is not in the pre-3.4 versions. So 3.0 to 3.3 are not secure.
AOO 4.1.4 on Xubuntu 17.10, (Artful Aardvark) and 4.1.3 on Windows 7 (with winPenPack port).
User avatar
Hagar Delest
Moderator
 
Posts: 27654
Joined: Sun Oct 07, 2007 9:07 pm
Location: France

Re: OOo 3.0 - 3.3 (ODF 1.2) Security patch

Postby Talvi » Tue Apr 03, 2012 10:29 am

Thanks Hagar :)
Hagar Delest wrote:
Talvi wrote:does the "scrubbing" ref means open/save in any (?) earlier file types?
Sorry I'm not sure I understand.

I understand that ODF files in 1.2 format contain the "problem" whether or not a patch is applied to the program or a later program version eg 3.4 is used. I was asking if the way to deal with 1.2 format files was to open and save each to an earlier file type. (or if a batch process for instance was available to do this? Or..?)

Got it that using earlier file formats are considered better. Personally long ago I developed the habit, first with Office, of saving into earlier formats to ensure readability by people using earlier software versions. This avoids higher order bugs and the problems caused by general overcomplication of functionality and the different interpretations/display by different systems of the more "advanced" features etc etc. (I am a fundamentalist KISS believer - "Keep it simple! Stupid!") and am generally skeptical of the security rational (ab)used by software vendors to "upgrade" their products.

Is there any reason not to move across to AOO now? Is the current "dev version" that has been released the same as OOo? Or..?

Thanks for the clarification on Phil's post. In this area does the phrase "security bulletin" always mean not a bulletin but a fix ie is: "security bulletin", shorthand for: "updated installations of the software with the bug fixed" ..?

Can you answer the question about muCommander - where to get it?
OpenOffice 3.3 on Windows 7
Talvi
 
Posts: 59
Joined: Sat Dec 10, 2011 7:25 pm

Re: OOo 3.0 - 3.3 (ODF 1.2) Security patch

Postby Hagar Delest » Tue Apr 03, 2012 11:25 am

Talvi wrote:I understand that ODF files in 1.2 format contain the "problem" whether or not a patch is applied to the program or a later program version eg 3.4 is used. I was asking if the way to deal with 1.2 format files was to open and save each to an earlier file type. (or if a batch process for instance was available to do this? Or..?)

No. My understanding is that ODF 1.2 allows the embedding of personal data inside ODF 1.2 documents (because of a feature specific to 1.2). But the action (embedding data in a document) is possible only with an additional code (you have to be attacked or infected) in an ODF 1.2 document. I guess that the patch prevents the use of the library used to embed the personal data, which may be an abnormal use of this library.

Moreover, you have to send the corrupted file to someone who is aware of the leakage and who knows how to get the data hidden in the file.
AOO 4.1.4 on Xubuntu 17.10, (Artful Aardvark) and 4.1.3 on Windows 7 (with winPenPack port).
User avatar
Hagar Delest
Moderator
 
Posts: 27654
Joined: Sun Oct 07, 2007 9:07 pm
Location: France

Re: OOo 3.0 - 3.3 (ODF 1.2) Security patch

Postby Talvi » Tue Apr 03, 2012 11:55 am

Far out Hagar! :super: Thanks, I will sleep easy now :) and, in my situation, upgrade when there's a version with the bug fixed ..... any reason NOT to move across to the dev version of AOO now??? It is the future after all...
OpenOffice 3.3 on Windows 7
Talvi
 
Posts: 59
Joined: Sat Dec 10, 2011 7:25 pm

Re: OOo 3.0 - 3.3 (ODF 1.2) Security patch

Postby RoryOF » Tue Apr 03, 2012 12:13 pm

Best wait a few days for the release version; some ancillaries, such as dictionaries, are currently being checked for compatibility.
Apache OpenOffice 4.1.4 on Xubuntu 16.04.03 (mostly 64 bit version) and infrequently on Win2K/XP
14 October 2016 was Pooh's 90th birthday
User avatar
RoryOF
Moderator
 
Posts: 25483
Joined: Sat Jan 31, 2009 9:30 pm
Location: Ireland

Re: OOo 3.0 - 3.3 (ODF 1.2) Security patch

Postby Talvi » Tue Apr 03, 2012 2:13 pm

Thanks Rory :) I'll keep an eye out ....
OpenOffice 3.3 on Windows 7
Talvi
 
Posts: 59
Joined: Sat Dec 10, 2011 7:25 pm

Re: OOo 3.0 - 3.3 (ODF 1.2) Security patch

Postby PGAGA » Tue Apr 03, 2012 4:55 pm

April 3, 2012

MuCommander is found at mucommander.com. It is a java gui for file management. I like seeing what I am doing with file management, so use it.

Another option for installation of the patch would be a command line such as:

unzip CVE-2012-0037-win.zip "C:\Program Files\OpenOffice.org 3\program\"

You should be asked if you want to overwrite the file being replaced.

Phil
OpenOffice.org 3.2.x, StarOffice 5.1, 7, 8 - OS X, WinXP, OS/2
StarOffice 7, 8, Oracle Open Office 3.3.1, LibreOffice 3.x.x - OS X, Ubuntu, WinXP
NeoOffice 2.2.6, 3.1.2, 3.2.x 3.3 - OS X
Apache OpenOffice 3.4.x - WinXP, OS X, OS/2
PGAGA
Volunteer
 
Posts: 481
Joined: Sun Dec 07, 2008 10:54 pm

Re: OOo 3.0 - 3.3 (ODF 1.2) Security patch

Postby Talvi » Wed Apr 04, 2012 8:21 am

D'Oh! Thanks Phil :) MuCommander sounds interesting. I find File Manager in Win7 a bit irritating.
OpenOffice 3.3 on Windows 7
Talvi
 
Posts: 59
Joined: Sat Dec 10, 2011 7:25 pm

Re: OOo 3.0 - 3.3 (ODF 1.2) Security patch

Postby vidsag » Sun Apr 08, 2012 5:38 pm

thank you for providing efficient office software and found more useful in comparision with MSOffice version in respect of flexibility of file formats.
Regarding OS many laptop/desktop computer manufacturers does not providing drivers for free os available in the market but the promenant OS marketers copying the features of free OS available in the market. ex. MSoffice2007 ribbon on menu bar rather than drop down menu.
OpenOffice.ord3.3; windows 7 home basic
vidsag
 
Posts: 1
Joined: Sun Apr 08, 2012 5:06 pm

Re: OOo 3.0 - 3.3 (ODF 1.2) Security patch

Postby Newbie » Mon Apr 16, 2012 4:51 am

folks,

i have just become aware of this security issue with the v3.3 that you guys are talking about, btw thanks for sharing. i'm a first time user of this suit (which i love very much) but right now i'm at a loss not knowing what the heck to do. :crazy:

i followed hagar's instructions and went to load/save, general....i've never been to this section before this.....which means i've been saving my documents with the default settings all this time and my default "save" setting is "ODF 1.2 Extended". from what i've gathered here, that means i'm right in the line of fire.

question is what do i do? uninstall and wait for the next version to come out? or is there a way for me to fix this? please advice. :crazy:
OpenOffice 3.4.1 on Windows 7 ultimate x64
Newbie
 
Posts: 23
Joined: Tue Mar 20, 2012 2:59 pm

Re: OOo 3.0 - 3.3 (ODF 1.2) Security patch

Postby kingfisher » Mon Apr 16, 2012 6:21 am

Look at the message quoted in the first post. Go to the page linked and download the file/s for your system. Included in the download there is, I understand, a pdf file containing instructions on how to install the patch.
Apache OpenOffice 4.1.2 (64 bit) on PCLinuxOS
User avatar
kingfisher
Volunteer
 
Posts: 2109
Joined: Tue Nov 20, 2007 10:53 am

Re: OOo 3.0 - 3.3 (ODF 1.2) Security patch

Postby Newbie » Mon Apr 16, 2012 2:25 pm

yes kingfisher,

i did look at the first post, followed the link to the download pg. i actually downloaded the file and downloaded the signature file as well, but this is all just too much for me to handle.

i dont know that much about these things to get tangled up in this. it just sounds a bit too complicated for me.
.....download the patch then download something else to check the signature of the patch and if some key for the signature is missing then you have to go to somewhere else to download the key etc etc. i just don't think i'll be able to handle this successfully.

anybody knows when the new version will be out?
OpenOffice 3.4.1 on Windows 7 ultimate x64
Newbie
 
Posts: 23
Joined: Tue Mar 20, 2012 2:59 pm

Re: OOo 3.0 - 3.3 (ODF 1.2) Security patch

Postby acknak » Mon Apr 16, 2012 3:21 pm

I'm guessing that you may not need to worry about it.

This is not the kind of security problem that opens your system to attack, like a virus or key logger. The worst that can happen here is that a file on your computer could be secretly sent out to someone else. That could be a really big problem, but the attack requires your participation: it's not effective at all unless you open a document that comes from someone you don't know (or trust) and send it back.

Note: that scenario could work by downloading a document from this forum, editing it, and uploading it here again!

If you only work with your own documents, that you create on your computer, you're completely safe, even without the patch.
AOO4/LO5 • Linux • Fedora 23
User avatar
acknak
Moderator
 
Posts: 22681
Joined: Mon Oct 08, 2007 1:25 am
Location: USA:NJ:E3

Re: OOo 3.0 - 3.3 (ODF 1.2) Security patch

Postby PGAGA » Mon Apr 16, 2012 4:56 pm

April 16, 2012

Newbie wrote:i dont know that much about these things to get tangled up in this. it just sounds a bit too complicated for me.


Ok here is how I would do this (more correctly how I do it). Download and install mucommander from mucommander.com.

Once installed, open it as administrator (right click will give you this option). Do this if you installed OOo as administrator (you would have been asked for a password if you installed as administrator).

In the left pane, navigate to C:\Program Files\OpenOffice.org 3\program\. Since you are using Win7 it may be
C:\Program files(x86)\OpenOffice.org3\program.

In the right pane, navigate to where you downloaded CVE-2012-0037-win.zip. Double click on it and it will open the file. Select unordfmi.dll and then use the button to copy the file. You should be asked if you want to overwrite the file in the left pane. Hit yes and exit mucommander and you are updated.

If you want to be cautious you could rename the unordfmi.dll in the left pane before copying to back it up.

Phil
OpenOffice.org 3.2.x, StarOffice 5.1, 7, 8 - OS X, WinXP, OS/2
StarOffice 7, 8, Oracle Open Office 3.3.1, LibreOffice 3.x.x - OS X, Ubuntu, WinXP
NeoOffice 2.2.6, 3.1.2, 3.2.x 3.3 - OS X
Apache OpenOffice 3.4.x - WinXP, OS X, OS/2
PGAGA
Volunteer
 
Posts: 481
Joined: Sun Dec 07, 2008 10:54 pm

Re: OOo 3.0 - 3.3 (ODF 1.2) Security patch

Postby Newbie » Tue Apr 17, 2012 3:00 am

somehow i know i can always count on you guys for help when it comes to issues pertaining to this great program. i do respect you all and most importantly, appreciate your help very much. glad to be a member of this community.

yes! i got updated. :bravo:

acknak, thanks very much for those reassuring words. i was just about to do an uninstall but you managed to calm me down. thanks man.

phil, phil, phil.....aka pgaga.....buddy what can i tell you, except to say thank you, thank you, thank you. you made it all seem so easy. all i had to do was to go to mucommander's site and download the app, install it, follow your instructions.....which was very very well laid out.....and within a minuet or two i was updated.....how easier can it get.

thank you all again folks.
OpenOffice 3.4.1 on Windows 7 ultimate x64
Newbie
 
Posts: 23
Joined: Tue Mar 20, 2012 2:59 pm

Re: OOo 3.0 - 3.3 (ODF 1.2) Security patch

Postby zmotiwala » Wed Jul 10, 2013 9:34 pm

We cannot upgrade the open office we ship with, becasue we have use a portable version. Is there an example of this odf scrub zip utility that hagar mentions?

Also does this affect ONLY .odt files?
Open Office 3.0
Windows
zmotiwala
 
Posts: 36
Joined: Wed Dec 28, 2011 5:34 pm


Return to Announcements

Who is online

Users browsing this forum: No registered users and 1 guest