Bugzilla Bug 63556

SecurityTracker Alert ID:  1011205
SecurityTracker URL:  http://securitytracker.com/id?1011205
CVE Reference:  GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Sep 10 2004
Impact:  Disclosure of user information
Fix Available:  Yes   Exploit Included:  Yes   Vendor Confirmed:  Yes  
Version(s): 1.1.2
Description:  A vulnerability was reported in OpenOffice. A local user may be able to obtain documents belonging to another local user.

pmladek reported that the software uses insecure temporary files. When started, OpenOffice creates a world-readable temporary directory ('/tmp/sv<RAND>.tmp'). When an OpenOffice file is saved, a compressed version (zip file) is saved in the temporary directory.

A local user can access the temporary directory and obtain the file.
Impact:  A local user can obtain information belonging to another local user.
Solution:  The vendor has issued a fix, available via CVS.
Vendor URL:  www.openoffice.org/issues/show_bug.cgi?id=33357 (Links to External Site)
Cause:  Access control error, State error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   None. 

Reproducible: Always
Steps to Reproduce:

OpenOffice team, please confirm fix

see also http://secunia.com/advisories/12302/

CAN-2004-0752

fixed for Red Hat (RHSA-2004:446-08)

SA12302:
"Solution:
The vulnerability has been fixed in Product Update 3 for StarOffice and a release candidate of OpenOffice 1.1.3."

OpenOffice team, please comment on the status of a fix for this

To me this really is a minor issue, I think we can wait until 1.1.3 is out. 

setting status to [upstream]
1.1.3 seems to be coming soon

This is already fixed in openoffice-ximian-1.3.4

Mandrake just released their fix:

http://www.mandrakesoft.com/security/advisories?name=MDKSA-2004:103

going back to ebuild status, since 1.1.3 has been released

OpenOffice team, could you please comment on the bug when the OOo ebuilds have
reached stable

security, any votes on a GLSA since this is rated B4?

I think we should issue a GLSA. This package is very common, it leaks complete
documents and is really easy. RedHat and Mandrake released advisories on this
too.

Oops... well actually time for some testing and stable marking...
Since only 1.1.2 is said to be affected, we will need the following:

openoffice-bin-1.1.3:
current KEYWORDS="~x86"
target KEYWORDS="x86 amd64"

openoffice-1.1.3:
current KEYWORDS="~x86"
target KEYWORDS="x86"

_____

openoffice-ximian-1.3.4:
target KEYWORDS="~x86 ~ppc" reached already

openoffice-ximian-bin only has 1.1.53, no work needed either

stable on amd64

Any progress on marking this stable on x86 so far?

This has been in [stable] status for 5 days and has been opened about a month ago already.

openoffice and openoffice-bin 1.1.3 are now stable on x86, still there is a lot
to do:

*) Need to mark a newer openoffice-ximian stable on x86, the current stable
doesn't have the fix. Just commited a new version into unstable which I hope to
mark stable in the next few days.

*) There is no version of openoffice-ximian-bin which is not vulnerable, as we
are depending on upstream binaries (in this case from Ximian) and there is no
newer version, I am going to mask it at whole in package.mask until we get a
newer binary

*) Other archs will have to check all three package:

openoffice-bin:
ppc (now at 1.1.1)

openoffice:
sparc (1.1.0-r4), ppc (1.0.3-r2!)

openoffice-ximian:
ppc (1.1.55), sparc (1.1.61)

openoffice-ximian-bin is now masked, people should upgrade to a recent
openoffice-ximian

Arches... please test and mark stable if possible...


to be on the safe side we should end up with:

openoffice-1.1.3:
current KEYWORDS="x86"
target KEYWORDS="x86 sparc ppc"

openoffice-bin-1.1.3:
current KEYWORDS="x86 amd64"
target KEYWORDS="x86 amd64 ppc"

openoffice-ximian-1.3.5-r1:
current KEYWORDS="~x86 ~ppc"
target KEYWORDS="x86 ppc sparc"

Hmmm... In fact we don't need as much, since only 1.1.2 versions are affected.
openoffice and openoffice-bin already have the necessary keywords !

For openoffice-ximian it's slightly more complicated, as we don't "see" the oo
version used. In fact we have:
1.1.55 -> 1.1.1 (unaffected)
1.1.61, -> 1.1.2 (affected)
1.3.4, 1.3.5 -> 1.1.2 but patched (unaffected)

So we just need for openoffice-ximian-1.3.5-r1:
current KEYWORDS="~x86 ~ppc"
target KEYWORDS="x86 ~ppc sparc"

All in all, only x86 and sparc still have keywording work (removing ppc).
However, all arches can/should test and mark stable the latest version if they
can.

So just to be straight, regular plain old openoffice-1.1.1 is not vulnerable,
correct?  I'm just asking as 1.1.2 and 1.1.3 have build problems on sparc right
now and on a good day when things do compile, it takes about 36 hours or so to
build.

Yes, 1.1.1 OO.org (and 1.1.1-derived ximian-OO.org) is not vulnerable. The
ppc/gcc3.4/OO113.org build problem does not block this security bug.

Just marked openoffice-ximian 1.3.5-r1 stable, so x86 should be fine

openoffice-ximian-1.3.5-r1 stable on sparc.

So we should be set... vorlon, please draft :)

Andreas, wrt comment #15, ximian-openoffice-bin-1.1.53 is 1.1.1-based, right ?
So it wouldn't be affected by this vulnerability ? If so, there would be no
need for security masking (feel free to keep the mask for other reasons).

Please confirm as our GLSA contents depend on it...

@Koon: Yes you are right, my fault, will unmask it again. Thanks for noting

GLSA 200410-17