Vulnerabilities > CVE-2010-3689 - Path Traversal vulnerability in multiple products

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Debian Security Advisory DSA-2151. The text 
# itself is copyright (C) Software in the Public Interest, Inc.
#

include("compat.inc");

if (description)
{
  script_id(51677);
  script_version("1.18");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");

  script_cve_id("CVE-2010-3450", "CVE-2010-3451", "CVE-2010-3452", "CVE-2010-3453", "CVE-2010-3454", "CVE-2010-3689", "CVE-2010-4253", "CVE-2010-4643");
  script_xref(name:"DSA", value:"2151");

  script_name(english:"Debian DSA-2151-1 : openoffice.org - several vulnerabilities");
  script_summary(english:"Checks dpkg output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Debian host is missing a security-related update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Several security related problems have been discovered in the
OpenOffice.org package that allows malformed documents to trick the
system into crashes or even the execution of arbitrary code.

  - CVE-2010-3450
    During an internal security audit within Red Hat, a
    directory traversal vulnerability has been discovered in
    the way OpenOffice.org 3.1.1 through 3.2.1 processes XML
    filter files. If a local user is tricked into opening a
    specially crafted OOo XML filters package file, this
    problem could allow remote attackers to create or
    overwrite arbitrary files belonging to local user or,
    potentially, execute arbitrary code.

  - CVE-2010-3451
    During his work as a consultant at Virtual Security
    Research (VSR), Dan Rosenberg discovered a vulnerability
    in OpenOffice.org's RTF parsing functionality. Opening a
    maliciously crafted RTF document can cause an
    out-of-bounds memory read into previously allocated heap
    memory, which may lead to the execution of arbitrary
    code.

  - CVE-2010-3452
    Dan Rosenberg discovered a vulnerability in the RTF file
    parser which can be leveraged by attackers to achieve
    arbitrary code execution by convincing a victim to open
    a maliciously crafted RTF file.

  - CVE-2010-3453
    As part of his work with Virtual Security Research, Dan
    Rosenberg discovered a vulnerability in the
    WW8ListManager::WW8ListManager() function of
    OpenOffice.org that allows a maliciously crafted file to
    cause the execution of arbitrary code.

  - CVE-2010-3454
    As part of his work with Virtual Security Research, Dan
    Rosenberg discovered a vulnerability in the
    WW8DopTypography::ReadFromMem() function in
    OpenOffice.org that may be exploited by a maliciously
    crafted file which allows an attacker to control program
    flow and potentially execute arbitrary code.

  - CVE-2010-3689
    Dmitri Gribenko discovered that the soffice script does
    not treat an empty LD_LIBRARY_PATH variable like an
    unset one, which may lead to the execution of arbitrary
    code.

  - CVE-2010-4253
    A heap based buffer overflow has been discovered with
    unknown impact.

  - CVE-2010-4643
    A vulnerability has been discovered in the way
    OpenOffice.org handles TGA graphics which can be tricked
    by a specially crafted TGA file that could cause the
    program to crash due to a heap-based buffer overflow
    with unknown impact."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2010-3450"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2010-3451"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2010-3452"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2010-3453"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2010-3454"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2010-3689"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2010-4253"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2010-4643"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.debian.org/security/2011/dsa-2151"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"Upgrade the OpenOffice.org packages.

For the stable distribution (lenny) these problems have been fixed in
version 2.4.1+dfsg-1+lenny11.

For the upcoming stable distribution (squeeze) these problems have
been fixed in version 3.2.1-11+squeeze1."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:openoffice.org");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:5.0");

  script_set_attribute(attribute:"patch_publication_date", value:"2011/01/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2011/01/27");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2011-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Debian Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("debian_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (deb_check(release:"5.0", prefix:"openoffice.org", reference:"2.4.1+dfsg-1+lenny11")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Gentoo Linux Security Advisory GLSA 201408-19.
#
# The advisory text is Copyright (C) 2001-2019 Gentoo Foundation, Inc.
# and licensed under the Creative Commons - Attribution / Share Alike 
# license. See http://creativecommons.org/licenses/by-sa/3.0/
#

include("compat.inc");

if (description)
{
  script_id(77467);
  script_version("1.10");
  script_cvs_date("Date: 2019/08/12 17:35:38");

  script_cve_id("CVE-2006-4339", "CVE-2009-0200", "CVE-2009-0201", "CVE-2009-0217", "CVE-2009-2949", "CVE-2009-2950", "CVE-2009-3301", "CVE-2009-3302", "CVE-2010-0395", "CVE-2010-2935", "CVE-2010-2936", "CVE-2010-3450", "CVE-2010-3451", "CVE-2010-3452", "CVE-2010-3453", "CVE-2010-3454", "CVE-2010-3689", "CVE-2010-4253", "CVE-2010-4643", "CVE-2011-2713", "CVE-2012-0037", "CVE-2012-1149", "CVE-2012-2149", "CVE-2012-2334", "CVE-2012-2665", "CVE-2014-0247");
  script_bugtraq_id(35671, 36200, 38218, 40599, 42202, 46031, 49969, 52681, 53570, 54769, 68151);
  script_xref(name:"GLSA", value:"201408-19");

  script_name(english:"GLSA-201408-19 : OpenOffice, LibreOffice: Multiple vulnerabilities");
  script_summary(english:"Checks for updated package(s) in /var/db/pkg");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Gentoo host is missing one or more security-related
patches."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The remote host is affected by the vulnerability described in GLSA-201408-19
(OpenOffice, LibreOffice: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenOffice and
      Libreoffice. Please review the CVE identifiers referenced below for
      details.
  
Impact :

    A remote attacker could entice a user to open a specially crafted file
      using OpenOffice, possibly resulting in execution of arbitrary code with
      the privileges of the process, a Denial of Service condition, execution
      of arbitrary Python code, authentication bypass, or reading and writing
      of arbitrary files.
  
Workaround :

    There is no known workaround at this time."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security.gentoo.org/glsa/201408-19"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"All OpenOffice (binary) users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose
      '>=app-office/openoffice-bin-3.5.5.3'
    All LibreOffice users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=app-office/libreoffice-4.2.5.2'
    All LibreOffice (binary) users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose
      '>=app-office/libreoffice-bin-4.2.5.2'
    We recommend that users unmerge OpenOffice:
      # emerge --unmerge 'app-office/openoffice'"
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_cwe_id(94, 119, 189, 310);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:libreoffice");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:libreoffice-bin");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:openoffice");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:openoffice-bin");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");

  script_set_attribute(attribute:"vuln_publication_date", value:"2006/09/05");
  script_set_attribute(attribute:"patch_publication_date", value:"2014/08/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/09/01");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Gentoo Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("qpkg.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;

if (qpkg_check(package:"app-office/libreoffice", unaffected:make_list("ge 4.2.5.2"), vulnerable:make_list("lt 4.2.5.2"))) flag++;
if (qpkg_check(package:"app-office/libreoffice-bin", unaffected:make_list("ge 4.2.5.2"), vulnerable:make_list("lt 4.2.5.2"))) flag++;
if (qpkg_check(package:"app-office/openoffice-bin", unaffected:make_list("ge 3.5.5.3"), vulnerable:make_list("lt 3.5.5.3"))) flag++;
if (qpkg_check(package:"app-office/openoffice", unaffected:make_list(), vulnerable:make_list("le 3.5.5.3"))) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = qpkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "OpenOffice / LibreOffice");
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory 2011-0837.
#

include("compat.inc");

if (description)
{
  script_id(52004);
  script_version("1.15");
  script_cvs_date("Date: 2019/08/02 13:32:33");

  script_cve_id("CVE-2010-3450", "CVE-2010-3451", "CVE-2010-3452", "CVE-2010-3453", "CVE-2010-3454", "CVE-2010-3689", "CVE-2010-4253", "CVE-2010-4643");
  script_bugtraq_id(46031);
  script_xref(name:"FEDORA", value:"2011-0837");

  script_name(english:"Fedora 13 : openoffice.org-3.2.0-12.35.fc13 (2011-0837)");
  script_summary(english:"Checks rpm output for the updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"  - Thu Jan 27 2011 Caolan McNamara <caolanm at redhat.com>-
    1:3.2.0-12.35

    - CVE-2010-3450 Extensions and filter package files

    - CVE-2010-3451 / CVE-2010-3452 RTF documents

    - CVE-2010-3453 / CVE-2010-3454 Word documents

    - CVE-2010-3689 LD_LIBRARY_PATH usage

    - CVE-2010-4253 PNG graphics

    - CVE-2010-4643 TGA graphics

    - Resolves: rhbz#648475 Crash in scanner dialog

    - Resolves: rhbz#657628 divide-by-zero

    - Resolves: rhbz#657718 Crash in SwObjectFormatterTxtFrm

    - Resolves: rhbz#660312 SDK setup script creates invalid
      variables (dtardon)

  - Resolves: rhbz#663780 extend neon mutex locking

    - Resoves: rhbz#577525 [abrt] crash in
      ImplRegionBase::~ImplRegionBase (dtardon)

  - Tue Oct 26 2010 Caolan McNamara <caolanm at redhat.com>
    - 1:3.2.0-12.34

    - Resolves: rhbz#636521 crash in undo in sc

    - Resolves: rhbz#641637 [abrt] [presentation-minimizer]
      crash in OptimizationStats::GetStatusValue (dtardon)

  - make LD_PRELOAD of libsalalloc_malloc.so work again
    (dtardon)

    - Resolves: rhbz#642996 [abrt]
      CffSubsetterContext::readDictOp (dtardon)

    - Fri Oct 15 2010 Caolan McNamara <caolanm at
      redhat.com> - 1:3.2.0-12.33

    - Resolves: rhbz#637838 Cropped pictures are displayed
      in entirety in handouts (dtardon)

  - Tue Oct 12 2010 Caolan McNamara <caolanm at redhat.com>
    - 1:3.2.0-12.32

    - Resolves: rhbz#568277 workaround to avoid the crash
      (dtardon)

    - Resolves: rhbz#631543 [abrt] crash on dereferencing
      dangling pointer passed down from SwCalc::Str2Double
      (dtardon)

  - Resolves: rhbz#631823 Line and Filling toolbar glitch on
    theme change (caolanm)

  - Resolves: rhbz#637738 threading problems with using
    libgcrypt via neon when libgcrypt which was initialized
    by cups to be non-thread safe (caolanm)

  - Resolves: rhbz#632326 [abrt] [docx] _Construct<long,
    long> crash (dtardon)

  - Fri Aug 13 2010 Caolan McNamara <caolanm at redhat.com>
    - 1:3.2.0-12.31

    - Resolves: rhbz#623800 gnome-shell/mutter focus
      problems

    - Thu Aug 12 2010 Caolan McNamara <caolanm at
      redhat.com> - 1:3.2.0-12.30

    - Resolves: rhbz#623609 CVE-2010-2935 CVE-2010-2936

    - Mon Aug 9 2010 Caolan McNamara <caolanm at redhat.com>
      - 1:3.2.0-12.29

    - Resolves: rhbz#601621 avoid using mmap for copying
      files

    - Sun Aug 8 2010 Caolan McNamara <caolanm at redhat.com>
      - 1:3.2.0-12.28

    - Resolves: rhbz#621248 32bit events in forms on 64bit

    - Resolves rhbz#618047 Brackets incorrectly render in
      presentations (dtardon)

  - Wed Aug 4 2010 Caolan McNamara <caolanm at redhat.com> -
    1:3.2.0-12.27

    - Resolves: rhbz#608114 cppu-lifecycle issues (caolanm)

    - Resolves: rhbz#566831 [abrt] crash in GetFrmSize
      (dtardon)

    - Resolves: rhbz#613278 [abrt] crash in SANE shutdown
      (caolanm)

    - Resolves: rhbz#620390 [abrt] crash in
      SfxViewFrame::GetFrame (dtardon)

    - Mon Jun 21 2010 Caolan McNamara <caolanm at
      redhat.com> - 1:3.2.0-12.26

[plus 34 lines in the Changelog]

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=602324"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=640241"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=640950"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=640954"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=641224"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=641282"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=658259"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=667588"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2011-February/054137.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?fc0856df"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected openoffice.org package."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:openoffice.org");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:13");

  script_set_attribute(attribute:"vuln_publication_date", value:"2011/01/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2011/01/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2011/02/17");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! ereg(pattern:"^13([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 13.x", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);

flag = 0;
if (rpm_check(release:"FC13", reference:"openoffice.org-3.2.0-12.35.fc13")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "openoffice.org");
}