中危 OpenOffice任意代码执行漏洞

CVE编号

CVE-2010-3454

利用情况

暂无

补丁情况

N/A

披露时间

2011-01-29
漏洞描述
OpenOffice是一款开放源代码的文字处理系统。当解析word文档时，从文档中直接读取两个符号短型以判断拷贝数据后需把NULL终止符放到何位置，由于没有对这些索引进行检查，攻击者可利用索引把空字节写入到内存两个任意位置，允许任意代码执行。
解决建议
用户可联系供应商获得最新的应用程序：http://www.openoffice.org/
参考链接
http://osvdb.org/70715
http://secunia.com/advisories/40775
http://secunia.com/advisories/42999
http://secunia.com/advisories/43065
http://secunia.com/advisories/43105
http://secunia.com/advisories/43118
http://secunia.com/advisories/60799
http://ubuntu.com/usn/usn-1056-1
http://www.cs.brown.edu/people/drosenbe/research.html
http://www.debian.org/security/2011/dsa-2151
http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2011:027
http://www.openoffice.org/security/cves/CVE-2010-3453_CVE-2010-3454.html
http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html
http://www.redhat.com/support/errata/RHSA-2011-0181.html
http://www.redhat.com/support/errata/RHSA-2011-0182.html
http://www.securityfocus.com/bid/46031
http://www.securitytracker.com/id?1025002
http://www.vsecurity.com/resources/advisory/20110126-1
http://www.vupen.com/english/advisories/2011/0230
http://www.vupen.com/english/advisories/2011/0232
http://www.vupen.com/english/advisories/2011/0279
https://bugzilla.redhat.com/show_bug.cgi?id=640954
受影响软件情况
# 类型 厂商 产品 版本 影响面
1
运行在以下环境
应用 sun openoffice.org 2.0.0 -
运行在以下环境
应用 sun openoffice.org 2.0.3 -
运行在以下环境
应用 sun openoffice.org 2.0.4 -
运行在以下环境
应用 sun openoffice.org 2.1.0 -
运行在以下环境
应用 sun openoffice.org 2.2.0 -
运行在以下环境
应用 sun openoffice.org 2.2.1 -
运行在以下环境
应用 sun openoffice.org 2.3.0 -
运行在以下环境
应用 sun openoffice.org 2.3.1 -
运行在以下环境
应用 sun openoffice.org 2.4.0 -
运行在以下环境
应用 sun openoffice.org 2.4.1 -
运行在以下环境
应用 sun openoffice.org 2.4.2 -
运行在以下环境
应用 sun openoffice.org 2.4.3 -
运行在以下环境
应用 sun openoffice.org 3.0.0 -
运行在以下环境
应用 sun openoffice.org 3.0.1 -
运行在以下环境
应用 sun openoffice.org 3.1.0 -
运行在以下环境
应用 sun openoffice.org 3.1.1 -
运行在以下环境
应用 sun openoffice.org 3.2.0 -
运行在以下环境
应用 sun openoffice.org 3.2.1 -
运行在以下环境
系统 centos_5 autocorr-da * Up to
(excluding)
3.1.1-19.5.el5_5.6
运行在以下环境
系统 centos_5 autocorr-es * Up to
(excluding)
3.1.1-19.5.el5_5.6
运行在以下环境
系统 centos_5 autocorr-fi * Up to
(excluding)
3.1.1-19.5.el5_5.6
运行在以下环境
系统 centos_5 autocorr-ru * Up to
(excluding)
3.1.1-19.5.el5_5.6
运行在以下环境
系统 centos_5 openoffice.org- * Up to
(excluding)
3.1.1-19.5.el5_5.6
运行在以下环境
系统 centos_5 openoffice.org-graphicfilter * Up to
(excluding)
3.1.1-19.5.el5_5.6
运行在以下环境
系统 centos_5 openoffice.org-impress-core * Up to
(excluding)
3.1.1-19.5.el5_5.6
运行在以下环境
系统 centos_5 openoffice.org-langpack-af_ZA * Up to
(excluding)
3.1.1-19.5.el5_5.6
运行在以下环境
系统 centos_5 openoffice.org-langpack-en * Up to
(excluding)
3.1.1-19.5.el5_5.6
运行在以下环境
系统 centos_5 openoffice.org-langpack-et_EE * Up to
(excluding)
3.1.1-19.5.el5_5.6
运行在以下环境
系统 centos_5 openoffice.org-langpack-fr * Up to
(excluding)
3.1.1-19.5.el5_5.6
运行在以下环境
系统 centos_5 openoffice.org-langpack-mai_IN * Up to
(excluding)
3.1.1-19.5.el5_5.6
运行在以下环境
系统 centos_5 openoffice.org-langpack-nl * Up to
(excluding)
3.1.1-19.5.el5_5.6
运行在以下环境
系统 centos_5 openoffice.org-langpack-pa * Up to
(excluding)
3.1.1-19.5.el5_5.6
运行在以下环境
系统 centos_5 openoffice.org-langpack-pt_BR * Up to
(excluding)
3.1.1-19.5.el5_5.6
运行在以下环境
系统 centos_5 openoffice.org-langpack-ru * Up to
(excluding)
3.1.1-19.5.el5_5.6
运行在以下环境
系统 centos_5 openoffice.org-langpack-sl_SI * Up to
(excluding)
3.1.1-19.5.el5_5.6
运行在以下环境
系统 centos_5 openoffice.org-langpack-ta_IN * Up to
(excluding)
3.1.1-19.5.el5_5.6
运行在以下环境
系统 centos_5 openoffice.org-math-core * Up to
(excluding)
3.1.1-19.5.el5_5.6
运行在以下环境
系统 centos_5 openoffice.org-rhino * Up to
(excluding)
3.1.1-19.5.el5_5.6
运行在以下环境
系统 centos_5 openoffice.org-wiki-publisher * Up to
(excluding)
3.1.1-19.5.el5_5.6
运行在以下环境
系统 oracle_6 autocorr-da * Up to
(excluding)
3.2.1-19.6.0.1.el6_0.5
运行在以下环境
系统 oracle_6 autocorr-es * Up to
(excluding)
3.2.1-19.6.0.1.el6_0.5
运行在以下环境
系统 oracle_6 autocorr-fi * Up to
(excluding)
3.2.1-19.6.0.1.el6_0.5
运行在以下环境
系统 oracle_6 autocorr-ru * Up to
(excluding)
3.2.1-19.6.0.1.el6_0.5
运行在以下环境
系统 oracle_6 openoffice.org- * Up to
(excluding)
3.2.1-19.6.0.1.el6_0.5
运行在以下环境
系统 oracle_6 openoffice.org-graphicfilter * Up to
(excluding)
3.2.1-19.6.0.1.el6_0.5
运行在以下环境
系统 oracle_6 openoffice.org-impress-core * Up to
(excluding)
3.2.1-19.6.0.1.el6_0.5
运行在以下环境
系统 oracle_6 openoffice.org-langpack-af_ZA * Up to
(excluding)
3.2.1-19.6.0.1.el6_0.5
运行在以下环境
系统 oracle_6 openoffice.org-langpack-en * Up to
(excluding)
3.2.1-19.6.0.1.el6_0.5
运行在以下环境
系统 oracle_6 openoffice.org-langpack-et_EE * Up to
(excluding)
3.2.1-19.6.0.1.el6_0.5
运行在以下环境
系统 oracle_6 openoffice.org-langpack-fr * Up to
(excluding)
3.2.1-19.6.0.1.el6_0.5
运行在以下环境
系统 oracle_6 openoffice.org-langpack-mai_IN * Up to
(excluding)
3.2.1-19.6.0.1.el6_0.5
运行在以下环境
系统 oracle_6 openoffice.org-langpack-nl * Up to
(excluding)
3.2.1-19.6.0.1.el6_0.5
运行在以下环境
系统 oracle_6 openoffice.org-langpack-pa * Up to
(excluding)
3.2.1-19.6.0.1.el6_0.5
运行在以下环境
系统 oracle_6 openoffice.org-langpack-pt_BR * Up to
(excluding)
3.2.1-19.6.0.1.el6_0.5
运行在以下环境
系统 oracle_6 openoffice.org-langpack-ru * Up to
(excluding)
3.2.1-19.6.0.1.el6_0.5
运行在以下环境
系统 oracle_6 openoffice.org-langpack-sl_SI * Up to
(excluding)
3.2.1-19.6.0.1.el6_0.5
运行在以下环境
系统 oracle_6 openoffice.org-langpack-ta_IN * Up to
(excluding)
3.2.1-19.6.0.1.el6_0.5
运行在以下环境
系统 oracle_6 openoffice.org-math-core * Up to
(excluding)
3.2.1-19.6.0.1.el6_0.5
运行在以下环境
系统 oracle_6 openoffice.org-rhino * Up to
(excluding)
3.2.1-19.6.0.1.el6_0.5
运行在以下环境
系统 oracle_6 openoffice.org-wiki-publisher * Up to
(excluding)
3.2.1-19.6.0.1.el6_0.5
运行在以下环境
系统 redhat_5 openoffice.org-base * Up to
(excluding)
1:3.1.1-19.5.el5_5.6
运行在以下环境
系统 redhat_6 autocorr-af * Up to
(excluding)
1:3.2.1-19.6.el6_0.5
运行在以下环境
系统 suse_10 boost-32bit * Up to
(excluding)
1.33.1-17.13.2.1
阿里云评分
6.3
  • 攻击路径
    远程
  • 攻击复杂度
    复杂
  • 权限要求
    无需权限
  • 影响范围
    越权影响
  • EXP成熟度
    N/A
  • 补丁情况
    N/A
  • 数据保密性
    数据泄露
  • 数据完整性
    无影响
  • 服务器危害
    服务器失陷
  • 全网数量
    N/A
CWE-ID 漏洞类型
CWE-189 数值错误
CWE-193 Off-by-one错误
阿里云安全产品覆盖情况