New OpenOffice bug affects Mac, Linux, as well as Windows

Posted Sep 25th 2007 6:00PM by Ted Wallingford
Filed under: Security, Windows, Macintosh, Linux, OpenOffice.org

The forthcoming Aqua-native version of OpenOffice.

ZDNet UK is reporting that a just-discovered bug in OpenOffice can victimize versions of the software running on Mac and Linux in addition to Windows. The bug allows an attacker to use malformed TIFF images to run malicious code on the user's computer, ostensibly for the purpose of spreading the malicious code like a trojan. The official explanation of a heap overflow exploit can be found here. (Sounds likes when there's too much garbage in our can.)

OpenOffice's developers have not yet released a fix for the bug (update: the bug does not exist in version 2.3 or newer), but the firm that discovered it is advising OpenOffice users to "be careful" with attachments received from unknown sources. Good advice--whether you run OpenOffice, Microsoft Office, or Wordstar.

Tags: openoffice, security, virus, worm

Related Headlines

1 million viruses, worms, and trojans on the loose (30 days ago - 2 Comments)
The Internet Archive, busy protecting us from ourselves (3 days ago - 2 Comments)
AVG 8.0 Free released, now with protection from spyware (17 days ago - 27 Comments)
Yahoo! adds malware warnings to search results (5 days ago - 3 Comments)
Jotti's Malware Scan: Online virus scanner (12 days ago - 1 Comment)

Reader Comments (Page 1 of 1)

9-25-2007 @ 9:35PM

Chuck said...

But according to the ZDNet article: "The next version of OpenOffice (version 2.3) arrived on 17 September and is not affected by the flaw."

I installed 2.3, so I shouldn't be worried about this bug, correct?

9-26-2007 @ 1:49AM

James Roche said...

Maybe it would be kind to acknowledge the following:

1) It's taken a really long time for someone to discover, and no one yet has taken the opportunity to employ, this flaw.

2) The latest version already includes a patch.

This story comes across as a bit of a "just as bad as Microsoft" hit job. The fact is, when civilians find hackable flaws in Windows or IE, the fixes are insufferable and frequently ignored for a duration. This announcement is more noble than shameful, the Open Office movement deserves a retraction.

9-26-2007 @ 6:25AM

catchwa said...

Next time read the article, Ted. The have released a fix, it's called updating to the latest version.

9-26-2007 @ 6:19PM

Huw said...

The second paragraph of that article says that not only is it version 2.0.4 *and prior*, but also that version 2.3 is unaffected.

I think you should post an apology, Ted.

#	Blogger	Posts	Cmts
1	Brad Linder	172	19
2	Simon Kerbel	18	0
3	Romeo Wahed	15	0
4	Kristin Shoemaker	11	12
5	Todd Ritter	10	3
6	Danny Mendez	8	4
7	Christina Warren	7	3
8	Jason Clarke	7	5
9	Ian Dumych	5	5
10	Jay Hathaway	3	0
11	Gordon Finlayson	3	0
12	Michael Schleifstein	2	0
13	Dolores Parker	2	1
14	Grant Robertson	2	3
15	Emily Price	2	1
16	Lisa Hoover	1	1
17	Peter White	1	0
18	Nik Fletcher	1	0
19	Chris Ullrich	1	0
20	Cory Bohon	1	0

Blogger

Posts

Cmts

172

Japanese hardware sales, April 28 - May 4: Mothers in gaming edition Weekly Webcomic Wrapup looks up at the stars Apple Wiimote-esque patent revealed	Reminder, talkcast at 10 pm ET Sunday night AT&T: free iPhone wifi is coming at some point TUAW Best of the Week
TinEye image search engine launches public beta Innocent Spam: Displeased with the measurement of your Willy? eBay considers PayPal requirement, invites Australians antitrust scrutiny	Your tax dollars at work: Border guards hold up traffic to check out Challenger From the Awesome Files: V6 Miata auto-x weapon VW Rabbit gets a carrot from Consumer Reports
Apple promo references 2.6GHz MacBook Renault / Project Better Place shows off new electric sedan prototype E-Ink to introduce new segmented display cell displays	Sprint buzz not shared by analysts Sunday Funnies: Loan offers with small print and big consequences The Wal-Mart Weekly: Examining shareholder resolutions, Part 2