How to remediate – GLSA-200405-04 : OpenOffice.org vulnerability when using DAV s…

1. Introduction

The vulnerability GLSA-200405-04 affects OpenOffice.org due to a flaw in how it handles WebDAV servers. This means that if you use the WebDAV publishing feature and connect to a malicious server, an attacker could run code on your computer with your user permissions. Systems running OpenOffice.org with WebDAV enabled are at risk. Impact is likely to be high for confidentiality, integrity, and availability if exploited.

2. Technical Explanation

OpenOffice.org uses the Neon library when publishing documents to WebDAV servers. The Neon library contains format string vulnerabilities. An attacker can exploit these by sending specially crafted data through a malicious WebDAV server. This allows them to execute arbitrary code on the system running OpenOffice.org. CVE-2004-0179 details this vulnerability.

• Root cause: The Neon library does not properly validate format strings when handling input from WebDAV servers.
• Exploit mechanism: An attacker hosts a malicious WebDAV server and tricks the user into publishing a document to it. The crafted data triggers the format string vulnerabilities in Neon, allowing code execution.
• Scope: Affected versions of OpenOffice.org using the WebDAV publication feature on Gentoo systems are known to be vulnerable.

3. Detection and Assessment

You can check if your system is vulnerable by verifying the installed version of OpenOffice.org. Scanning with vulnerability management tools may also identify this issue.

• Quick checks: Use the following command to show the installed OpenOffice.org version: openoffice --version
• Scanning: Nessus and other scanners may have signatures for GLSA-200405-04, but check their documentation for details.
• Logs and evidence: There are no specific log entries to indicate exploitation; focus on identifying vulnerable versions of OpenOffice.org.

openoffice --version

4. Solution / Remediation Steps

The following steps will update your OpenOffice.org installation to a patched version, mitigating the vulnerability.

4.1 Preparation

• Ensure you have network connectivity to Gentoo package repositories. A rollback plan involves reverting to the previous OpenOffice.org version using your package manager’s history feature.
• A change window may be required depending on your organization’s policies. Approval from a system administrator might be needed.

4.2 Implementation

1. Step 1: Synchronize the portage tree: emerge sync
2. Step 2: Update OpenOffice.org based on your architecture. See below for specific commands.

4.3 Config or Code Example

No configuration changes are required; this fix involves updating the package.

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent similar issues. Least privilege reduces the impact of successful exploitation. Input validation prevents malicious data from being processed. Patch cadence ensures timely updates and mitigates known vulnerabilities.

• Practice 1: Apply the principle of least privilege to OpenOffice.org users, limiting their access rights.
• Practice 2: Avoid using WebDAV publication facilities if not required or connect only to trusted servers.

4.5 Automation (Optional)

Automation is possible through package management tools like Ansible or Chef.

# Example Ansible playbook snippet
- name: Update OpenOffice.org
  emerge:
    name: '>=app-office/openoffice-1.1.1-r1' # Adjust version as needed
    state: present

5. Verification / Validation

Confirm the fix by verifying the updated OpenOffice.org version and testing basic functionality.

• Post-fix check: Run openoffice --version to confirm the installed version is 1.1.1-r1 or later (depending on your architecture).
• Re-test: Re-run the initial version check to ensure the vulnerable version is no longer present.
• Smoke test: Open a document in OpenOffice.org and verify it opens and saves correctly.
• Monitoring: Monitor package manager logs for any failed updates or regressions.

openoffice --version

6. Preventive Measures and Monitoring

Update your security baselines to include the latest OpenOffice.org version. Incorporate vulnerability scanning into your CI/CD pipelines. Maintain a regular patch review cycle.

• Baselines: Update your system baseline or policy to require OpenOffice.org 1.1.1-r1 or later.
• Asset and patch process: Review and apply security patches for OpenOffice.org at least monthly, or more frequently if critical vulnerabilities are announced.

7. Risks, Side Effects, and Roll Back

Updating OpenOffice.org may cause compatibility issues with existing documents or macros. A rollback plan involves reverting to the previous version using your package manager.

• Risk or side effect 2: Potential conflicts with custom OpenOffice.org extensions. Disable and re-enable extensions if necessary.
• Roll back: emerge --rollback 'app-office/openoffice' (adjust package name as needed).

8. References and Resources

• Vendor advisory or bulletin: https://security.gentoo.org/glsa/200405-04
• NVD or CVE entry: CVE-2004-0179
• Product or platform documentation relevant to the fix: No specific documentation available.