Patch/Configuration Management, Vulnerability Management

OpenOffice patches Windows Metafile hole

The vendors who distribute OpenOffice issued a patch this week to fix a Windows Metafile (WMF) vulnerability in the open-source productivity suite.

The security hole opens up OpenOffice, a free alternative to Microsoft Office, to a buffer overflow attack through the creation of malicious WMF and Enhanced Metafile (EMF) files. If a user opens one of these files, it could allow for the execution of unauthorized code on the machine.

The flaw is similar to the critical WMF vulnerability found in Windows that lead Microsoft to release an out-of-cycle patch in January 2006.

Initially reported in October, the problem was discovered by John Heasman of NGSSoftware. Secunia rates the vulnerability as "highly critical" and recommends either to apply the fixes available on the OpenOffice website or to upgrade to OpenOffice 2.1.0.

NGSSoftware reported that it will withhold publishing full details about the flaw until April 2007.

"This three month window will allow users of OpenOffice the time needed to apply the patch before the details are released to the general public," said a statement on the company's website. "This reflects NGSSoftware's approach to responsible disclosure."

Click here to email West Coast Bureau Chief Ericka Chickowksi.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.