OpenOffice Java Applet系统访问漏洞

发布日期：2006-06-30
更新日期：2006-07-03

受影响系统：

Debian Linux 3.1
Sun StarOffice 8.0
Sun StarOffice 7.0
Sun StarOffice 6.0
RedHat Enterprise Linux WS 4
RedHat Enterprise Linux WS 3
RedHat Enterprise Linux ES 4
RedHat Enterprise Linux ES 3
RedHat Enterprise Linux AS 4
RedHat Enterprise Linux AS 3
OpenOffice OpenOffice <= 2.0.2

不受影响系统：

OpenOffice OpenOffice 2.0.3

描述：

---

BUGTRAQ ID: 18737
CVE(CAN) ID: CVE-2006-2199

OpenOffice是个整合性的软件，包含了许多文字处理、表格、公式等办公工具。

OpenOffice处理Java Applet时存在安全漏洞，本地或远程攻击者可能利用此漏洞绕过沙盒限制，以当前用户权限执行任意代码。

<*来源：OpenOffice.org

链接：http://www.openoffice.org/security/CVE-2006-2199.html
http://sunsolve.sun.com/search/printfriendly.do?assetkey=1-26-102475-1
http://www.debian.org/security/2005/dsa-1104
http://lwn.net/Alerts/189933
*>

建议：

---

临时解决方法：

OpenOffice.org 1.x :

在选项对话框中，选择Tools/Options/OpenOffice.org/Security --> 清除选择Enable Applets

OpenOffice.org 2.x

用文本编辑器编辑以下配置文件，并添加到OpenOffice.org设置中：

~/.openoffice2.0/user/registry/data/org/openoffice/Office/Common.xcu

<node oor:name="Java">
<node oor:name="Applet">
<prop oor:name="Enable" oor:type="xs:boolean">
<value>false</value>
</prop>
</node>
</node>

厂商补丁：

Debian
------
Debian已经为此发布了一个安全公告（DSA-1104-1）以及相应补丁:
DSA-1104-1：New OpenOffice.org packages fix several vulnerabilities
链接：http://www.debian.org/security/2005/dsa-1104

补丁下载：

Source archives:

http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org_1.1.3-9sarge2.dsc
Size/MD5 checksum: 2878 c29af36cea3d6f22c13f00dbe8247322
http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org_1.1.3-9sarge2.diff.gz
Size/MD5 checksum: 4627106 93c4a9d88d0a115df537a3d61cca82b9
http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org_1.1.3.orig.tar.gz
Size/MD5 checksum: 166568714 5250574bad9906b38ce032d04b765772

Architecture independent components:

http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-af_1.1.3-9sarge2_all.deb
Size/MD5 checksum: 2648322 4f7714aad4409e00e14ce332e486662e
http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-ar_1.1.3-9sarge2_all.deb
Size/MD5 checksum: 2695762 4141052d3207816b5368408da9b15975
http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-ca_1.1.3-9sarge2_all.deb
Size/MD5 checksum: 2692534 b4ccab7fbac287c3e217abd35763c63d
http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-cs_1.1.3-9sarge2_all.deb
Size/MD5 checksum: 3587602 f0e95ccc9b8d7b355584a8bc052e5686
http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-cy_1.1.3-9sarge2_all.deb
Size/MD5 checksum: 2664462 1c4c270ce73b183f56adb7e7b6ab79ab
http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-da_1.1.3-9sarge2_all.deb
Size/MD5 checksum: 3584076 ad6d82e05d64ed9e0e5bfa9fdb8ea1a3
http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-de_1.1.3-9sarge2_all.deb
Size/MD5 checksum: 3454874 6cc643abc1a34367f357b01979a9e74e
http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-el_1.1.3-9sarge2_all.deb
Size/MD5 checksum: 2742632 e21a6035232fe123b92da0e1a8b4ad6a
http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-en_1.1.3-9sarge2_all.deb
Size/MD5 checksum: 3526678 1dca9def45f48a04b58a1c8794280dfd
http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-es_1.1.3-9sarge2_all.deb
Size/MD5 checksum: 3563056 da70a829bcdf5357b1a9fb0d0c024f58
http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-et_1.1.3-9sarge2_all.deb
Size/MD5 checksum: 2646184 822b4acde201446a26ac6632688bbad9
http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-eu_1.1.3-9sarge2_all.deb
Size/MD5 checksum: 2670064 ad10df5ab47cd27da0249e03c472a042
http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-fi_1.1.3-9sarge2_all.deb
Size/MD5 checksum: 2674846 f72f73f8933d2e23d9fc02e3ef17330f

标签：

版权申明：本站文章部分自网络，如有侵权，请联系：west999com@outlook.com
特别注意：本站所有转载文章言论不代表本站观点，本站所提供的摄影照片，插画，设计作品，如需使用，请与原作者联系，版权归原作者所有