製品・ソフトウェアに関する情報

JVN脆弱性詳細

OpenOffice.org の filter/ww8/ww8par2.cxx におけるサービス運用妨害 (DoS) の脆弱性

Title	OpenOffice.org の filter/ww8/ww8par2.cxx におけるサービス運用妨害 (DoS) の脆弱性
Summary	OpenOffice.org の filter/ww8/ww8par2.cxx には、サービス運用妨害 (DoS) 状態となる、または任意のコードを実行される脆弱性が存在します。
Possible impacts	巧妙に細工された Word ドキュメントの sprmTSetBrc を使用したテーブルの処理に不備があるため、サービス運用妨害 (DoS) 状態にされる、または任意のコードを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Feb. 12, 2010, midnight
Registration Date	March 5, 2010, 10:33 a.m.
Last Update	March 5, 2010, 10:33 a.m.

CVSS2.0 : 危険
Score	9.3
Vector	AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected System

レッドハット

Red Hat Enterprise Linux 3 (as)

Red Hat Enterprise Linux 3 (es)

Red Hat Enterprise Linux 3 (ws)

Red Hat Enterprise Linux 4 (as)

Red Hat Enterprise Linux 4 (es)

Red Hat Enterprise Linux 4 (ws)

Red Hat Enterprise Linux 4.8 (as)

Red Hat Enterprise Linux 4.8 (es)

Red Hat Enterprise Linux Desktop 3.0

Red Hat Enterprise Linux Desktop 4.0

Red Hat Enterprise Linux Desktop 5.0 (client)

RHEL Desktop Workstation 5 (client)

RHEL Optional Productivity Applications 5 (server)

RHEL Optional Productivity Applications EUS 5.4.z (server)

OpenOffice.org Project

OpenOffice.org 3.2 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2009-3302	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3302
National Vulnerability Database (NVD)
2	CVE-2009-3302	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3302
OpenOffice.org
3	CVE-2009-3301 CVE-2009-3302	http://www.openoffice.org/security/cves/CVE-2009-3301-3302.html

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-94	https://jvndb.jvn.jp/ja/cwe/CWE-94.html

ベンダー情報

No	Name	URL
Red Hat Security Advisory
1	RHSA-2010:0101	https://rhn.redhat.com/errata/RHSA-2010-0101.html

その他

No	Name	URL
ISS X-Force Database
1	56241	http://xforce.iss.net/xforce/xfdb/56241
Secunia Advisory
2	SA38567	http://secunia.com/advisories/38567/
3	SA38568	http://secunia.com/advisories/38568/
SecurityFocus
4	38218	http://www.securityfocus.com/bid/38218
SecurityTracker
5	1023591	http://securitytracker.com/id?1023591
VUPEN Security
6	VUPEN/ADV-2010-0366	http://www.vupen.com/english/advisories/2010/0366

Change Log

No	Changed Details	Date of change
0	[2010年03月05日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2009-3302

Summary	filter/ww8/ww8par2.cxx in OpenOffice.org (OOo) before 3.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted sprmTSetBrc table property modifier in a Word document, related to a "boundary error flaw."
Publication Date	Feb. 17, 2010, 4:30 a.m.
Registration Date	Jan. 29, 2021, 1:23 p.m.
Last Update	Feb. 8, 2022, 2:05 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:apache:openoffice::::::::					3.2.0

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:canonical:ubuntu_linux:8.04::::-:::
cpe:2.3:o:canonical:ubuntu_linux:8.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:9.04:::::::*
cpe:2.3:o:canonical:ubuntu_linux:9.10:::::::*
cpe:2.3:o:debian:debian_linux:4.0:::::::*
cpe:2.3:o:debian:debian_linux:5.0:::::::*

Related information, measures and tools

No	URL	refsource	タグ
1	http://www.debian.org/security/2010/dsa-1995	DEBIAN	Third Party Advisory
2	http://secunia.com/advisories/38568	SECUNIA	Broken Link
3	http://www.vupen.com/english/advisories/2010/0366	VUPEN	Broken Link
4	http://secunia.com/advisories/38567	SECUNIA	Broken Link
5	http://www.openoffice.org/security/cves/CVE-2009-3301-3302.html	CONFIRM	Vendor Advisory
6	https://bugzilla.redhat.com/show_bug.cgi?id=533043	CONFIRM	Issue Tracking Third Party Advisory
7	http://securitytracker.com/id?1023591	SECTRACK	Broken Link Third Party Advisory VDB Entry
8	http://www.redhat.com/support/errata/RHSA-2010-0101.html	REDHAT	Broken Link
9	http://www.securityfocus.com/bid/38218	BID	Broken Link Third Party Advisory VDB Entry
10	http://www.openoffice.org/security/bulletin.html	CONFIRM	Vendor Advisory
11	http://secunia.com/advisories/38695	SECUNIA	Broken Link
12	http://www.ubuntu.com/usn/USN-903-1	UBUNTU	Third Party Advisory
13	http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html	SUSE	Third Party Advisory
14	http://secunia.com/advisories/38921	SECUNIA	Broken Link
15	http://www.vupen.com/english/advisories/2010/0635	VUPEN	Broken Link
16	http://www.vupen.com/english/advisories/2010/2905	VUPEN	Broken Link
17	http://www.us-cert.gov/cas/techalerts/TA10-287A.html	CERT	Third Party Advisory US Government Resource
18	http://www.mandriva.com/security/advisories?name=MDVSA-2010:221	MANDRIVA	Broken Link
19	http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml	GENTOO	Third Party Advisory
20	http://secunia.com/advisories/60799	SECUNIA	Broken Link
21	http://secunia.com/advisories/41818	SECUNIA	Broken Link
22	http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html	CONFIRM	Third Party Advisory
23	https://exchange.xforce.ibmcloud.com/vulnerabilities/56241	XF	Third Party Advisory VDB Entry
24	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10022	OVAL	Tool Signature

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-94	コード・インジェクション	https://cwe.mitre.org/data/definitions/94.html

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:canonical:ubuntu_linux:8.04::::-:::
cpe:2.3:o:canonical:ubuntu_linux:8.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:9.04:::::::*
cpe:2.3:o:canonical:ubuntu_linux:9.10:::::::*
cpe:2.3:o:debian:debian_linux:4.0:::::::*
cpe:2.3:o:debian:debian_linux:5.0:::::::*