#201270: Security Vulnerability in StarOffice/StarSuite URL Handler

Security Vulnerability in StarOffice/StarSuite URL Handler

Category :	Security
Release Phase :	Resolved
Bug Id :	6524949, 6524951, 6524953
Product :	StarOffice 7 Software StarOffice 6.0 Office Suite StarOffice 8 Software
Date of Workaround Release :	26-MAR-2007
Date of Resolved Release :	17-MAY-2007

Security Vulnerability in StarOffice/StarSuite URL Handler

1. Impact

A security vulnerability with the way StarOffice/StarSuite 6, 7 and 8 process hyperlinks (URLs) in documents may allow a remote unprivileged user who provides a StarOffice/StarSuite document that is opened by a local user the ability to execute arbitrary commands on the system with the privileges of the user running StarOffice/StarSuite.

This issue is also described in the following document:

CVE-2007-0239 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0239

2. Contributing Factors

This issue can occur in the following releases:

SPARC Platform

StarOffice/StarSuite 6.0 without patch 112885-07
StarOffice/StarSuite 7 without patch 116519-13
StarSuite 8 without patch 120189-10
StarOffice 8 without patch 120185-10

x86 Platform

StarOffice/StarSuite 6.0 PP6 without patch 112886-07
StarOffice/StarSuite 7 PP9 without patch 117073-11
StarSuite 8 without patch 120190-10
StarOffice 8 without patch 120186-10

Linux Platform

StarOffice/StarSuite 6.0 PP6 without patch 112887-07
StarOffice/StarSuite 7 PP9 without patch 116518-13
StarSuite 8 without patch 120188-09
StarOffice 8 without patch 120184-09

Note: StarOffice/StarSuite earlier versions will not be evaluated regarding this issue.

To determine the version of StarOffice installed on a system, the following command can be run (for <program dir>/program/bootstraprc):

    % grep Product bootstraprc
    ProductKey=StarOffice 8
    ProductPatch=(Product Update 2)

Or using the GUI, do the following (with StarOffice/StarSuite open):

Open the "Help" menu
Choose "About StarOffice" (StarSuite)

The version is displayed first in the "about" text.

3. Symptoms

There are no predictable symptoms that would indicate the described issue has occurred.

4. Workaround

There is no workaround for this issue. Please see the Resolution section below.

5. Resolution

This issue is addressed in the following releases:

SPARC Platform

StarOffice/StarSuite 6.0 with patch 112885-07 or later
StarOffice/StarSuite 7 with patch 116519-13 or later
StarSuite 8 with patch 120189-10 or later
StarOffice 8 with patch 120185-10 or later

x86 Platform

StarOffice/StarSuite 6.0 PP6 with patch 112886-07 or later
StarOffice/StarSuite 7 PP9 with patch 117073-11 or later
StarSuite 8 with patch 120190-10 or later
StarOffice 8 with patch 120186-10 or later

Linux Platform

StarOffice/StarSuite 6.0 PP6 with patch 112887-07 or later
StarOffice/StarSuite 7 PP9 with patch 116518-13 or later
StarSuite 8 with patch 120188-09 or later
StarOffice 8 with patch 120184-09 or later

For more information on Security Sun Alerts, see Technical Instruction ID 213557.

This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun Alert notification may contain information provided by third parties. The issues described in this Sun Alert notification may or may not impact your system(s). Sun makes no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert notification contains Sun proprietary and confidential information. It is being provided to you pursuant to the provisions of your agreement to purchase services from Sun, or, if you do not have such an agreement, the Sun.com Terms of Use. This Sun Alert notification may only be used for the purposes contemplated by these agreements.

Copyright 2000-2008 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.

Modification History

28-Apr-2008: Updated Resolution section to add link for Security Technical Instruction document

Date: 06-APR-2007

Updated Contributing Factors and Resolution sections

Date: 10-APR-2007

Updated Contributing Factors and Resolution sections

Date: 17-APR-2007

Updated Contributing Factors and Resolution sections

Date: 10-MAY-2007

Updated Contributing Factors and Resolution sections

Date: 17-MAY-2007

Updated Contributing Factors and Resolution sections
State: Resolved

Attachments

This solution has no attachment

Login Required

Login Required