Security News > 2021 > October > Digital Signature Spoofing Flaws Uncovered in OpenOffice and LibreOffice

The maintainers of LibreOffice and OpenOffice have shipped security updates to their productivity software to remediate multiple vulnerabilities that could be weaponized by malicious actors to alter documents to make them appear as if they are digitally signed by a trusted source.

Successful exploitation of the vulnerabilities could permit an attacker to manipulate the timestamp of signed ODF documents, and worse, alter the contents of a document or self-sign a document with an untrusted signature, which is then tweaked to change the signature algorithm to an invalid or unknown algorithm.

In both the latter two attack scenarios - stemming as a result of improper certificate validation - LibreOffice incorrectly displays a validly signed indicator suggesting that the document hasn't been tampered with since signing and presents a signature with an unknown algorithm as a legitimate signature issued by a trusted party.

The weaknesses have been fixed in OpenOffice version 4.1.11 and LibreOffice versions 7.0.5, 7.0.6, 7.1.1 as well as 7.1.2.

The findings are the latest in a series of flaws uncovered by the Ruhr-University Bochum researchers and follow similar attack techniques disclosed earlier this year that could potentially enable an adversary to modify a certified PDF document's visible content by displaying malicious content over the certi?ed content without invalidating its signature.

Users of LibreOffice and OpenOffice are advised to update to the latest version to mitigate the risk associated with the flaws.

News URL

http://feedproxy.google.com/~r/TheHackersNews/~3/g9JSslFw9Bc/digital-signature-spoofing-flaws.html