OpenOffice patches Windows Metafile hole

The security hole opens up OpenOffice, a free alternative to Microsoft Office, to a buffer overflow attack through the creation of malicious WMF and Enhanced Metafile (EMF) files. If a user opens one of these files, it could allow for the execution of unauthorised code on the machine.

The flaw is similar to the critical WMF vulnerability found in Windows that lead Microsoft to release an out-of-cycle patch in January 2006.

Initially reported in October, the problem was discovered by John Heasman of NGSSoftware. Secunia rates the vulnerability as "highly critical" and recommends either to apply the fixes available on the OpenOffice website or to upgrade to OpenOffice 2.1.0.

NGSSoftware reported that it will withhold publishing full details about the flaw until April 2007.

"This three month window will allow users of OpenOffice the time needed to apply the patch before the details are released to the general public," said a statement on the company's website. "This reflects NGSSoftware's approach to responsible disclosure."

Click here to email West Coast Bureau Chief Ericka Chickowksi.

holemetafileopenofficepatchessecuritywindows