製品・ソフトウェアに関する情報

JVN脆弱性詳細

Apache OpenOffice における任意のコマンドを実行される脆弱性

Title	Apache OpenOffice における任意のコマンドを実行される脆弱性
Summary	Apache OpenOffice には、任意のコマンドを実行されるなど、不特定の影響を受ける脆弱性が存在します。補足情報 : CWE による脆弱性タイプは、CWE-77: Improper Neutralization of Special Elements used in a Command (コマンドインジェクション) と識別されています。 http://cwe.mitre.org/data/definitions/77.html
Possible impacts	第三者により、巧妙に細工された Calc スプレットシートを介して、任意のコマンドを実行されるなど、不特定の影響を受ける可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Aug. 21, 2014, midnight
Registration Date	Aug. 28, 2014, 4:17 p.m.
Last Update	Aug. 28, 2014, 4:17 p.m.

Affected System

Apache Software Foundation

Apache OpenOffice 4.1.1 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2014-3524	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3524
National Vulnerability Database (NVD)
2	CVE-2014-3524	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3524

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-Other	https://www.ipa.go.jp/security/vuln/CWE.html#CWEOther

ベンダー情報

No	Name	URL
Apache OpenOffice
1	Top Page	http://www.openoffice.org/ja/

その他

No	Name	URL
関連文書
1	apache-openoffice-cve20143524-command-exec (95421)	http://xforce.iss.net/xforce/xfdb/95421

Change Log

No	Changed Details	Date of change
0	[2014年08月28日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2014-3524

Summary	Apache OpenOffice before 4.1.1 allows remote attackers to execute arbitrary commands and possibly have other unspecified impact via a crafted Calc spreadsheet.
Publication Date	Aug. 26, 2014, 11:55 p.m.
Registration Date	Jan. 26, 2021, 3:10 p.m.
Last Update	Nov. 21, 2024, 11:08 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:apache:openoffice::::::::					4.1.1

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:libreoffice:libreoffice::::::::	4.3.0			4.3.1
cpe:2.3:a:libreoffice:libreoffice::::::::				4.2.6

Related information, measures and tools

No	URL	タグ
1	http://blog.documentfoundation.org/2014/08/28/libreoffice-4-3-1-fresh-announced/	Vendor Advisory
2	http://blog.documentfoundation.org/2014/08/28/libreoffice-4-3-1-fresh-announced/	Vendor Advisory
3	http://secunia.com/advisories/59600	Broken Link
4	http://secunia.com/advisories/59600	Broken Link
5	http://secunia.com/advisories/59877	Broken Link
6	http://secunia.com/advisories/59877	Broken Link
7	http://secunia.com/advisories/60235	Broken Link
8	http://secunia.com/advisories/60235	Broken Link
9	http://www.openoffice.org/security/cves/CVE-2014-3524.html	Vendor Advisory
10	http://www.openoffice.org/security/cves/CVE-2014-3524.html	Vendor Advisory
11	http://www.securityfocus.com/archive/1/533200/100/0/threaded	Broken Link Third Party Advisory VDB Entry
12	http://www.securityfocus.com/archive/1/533200/100/0/threaded	Broken Link Third Party Advisory VDB Entry
13	http://www.securityfocus.com/bid/69351	Broken Link Third Party Advisory VDB Entry
14	http://www.securityfocus.com/bid/69351	Broken Link Third Party Advisory VDB Entry
15	http://www.securitytracker.com/id/1030755	Broken Link Third Party Advisory VDB Entry
16	http://www.securitytracker.com/id/1030755	Broken Link Third Party Advisory VDB Entry
17	https://exchange.xforce.ibmcloud.com/vulnerabilities/95421	Third Party Advisory VDB Entry
18	https://exchange.xforce.ibmcloud.com/vulnerabilities/95421	Third Party Advisory VDB Entry
19	https://security.gentoo.org/glsa/201603-05	Third Party Advisory
20	https://security.gentoo.org/glsa/201603-05	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-77	コマンドインジェクション	https://cwe.mitre.org/data/definitions/77.html