OpenOffice patches Windows Metafile hole

By

The vendors who distribute OpenOffice issued a patch this week to fix a Windows Metafile (WMF) vulnerability in the open-source productivity suite.


The security hole opens up OpenOffice, a free alternative to Microsoft Office, to a buffer overflow attack through the creation of malicious WMF and Enhanced Metafile (EMF) files. If a user opens one of these files, it could allow for the execution of unauthorised code on the machine.

The flaw is similar to the critical WMF vulnerability found in Windows that lead Microsoft to release an out-of-cycle patch in January 2006.

Initially reported in October, the problem was discovered by John Heasman of NGSSoftware. Secunia rates the vulnerability as "highly critical" and recommends either to apply the fixes available on the OpenOffice website or to upgrade to OpenOffice 2.1.0.

NGSSoftware reported that it will withhold publishing full details about the flaw until April 2007.

"This three month window will allow users of OpenOffice the time needed to apply the patch before the details are released to the general public," said a statement on the company's website. "This reflects NGSSoftware's approach to responsible disclosure."

Click here to email West Coast Bureau Chief Ericka Chickowksi.
Got a news tip for our journalists? Share it with us anonymously here.
Tags:

Most Read Articles

Qantas facing 'significant' data theft after cyber attack

Qantas facing 'significant' data theft after cyber attack

Home Affairs officer accessed data on "friends and associates"

Home Affairs officer accessed data on "friends and associates"

International Criminal Court hit by cyber attack

International Criminal Court hit by cyber attack

Ex-student charged over Western Sydney University cyberattacks

Ex-student charged over Western Sydney University cyberattacks

Log In

  |  Forgot your password?