Bug 893133 (CVE-2014-3524) - VUL-1: CVE-2014-3524: LibreOffice: Calc Command Injection Vulnerability
Summary: VUL-1: CVE-2014-3524: LibreOffice: Calc Command Injection Vulnerability
Status: RESOLVED INVALID
Alias: CVE-2014-3524
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: All SUSE Other
: P4 - Low : Major
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-08-22 12:33 UTC by Petr Mladek
Modified: 2022-02-01 15:41 UTC (History)
6 users (show)

See Also:
Found By: Third Party Developer/Partner
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Petr Mladek 2014-08-22 12:33:51 UTC 
Apache OpenOffice unexpectedly announced fixed security issue:

--- cut ---
From: Herbert Duerr <hdu@apache.org>
To: announce@openoffice.apache.org, dev@openoffice.apache.org, 
 users@openoffice.apache.org, full-disclosure@lists.grok.org.uk, 
 bugtraq@securityfocus.com
CC: zeroday@contextis.co.uk
Subject: CVE-2014-3524: Apache OpenOffice Calc Command Injection Vulnerability


CVE-2014-3524
OpenOffice Calc Command Injection Vulnerability

Severity: Important
Vendor: The Apache Software Foundation

Versions Affected:
	Apache OpenOffice 4.1.0 and older on Windows.
	OpenOffice.org versions may also be affected.

Description:
	The vulnerability allows command injection when loading Calc spreadsheets. Specially crafted documents can be used for command-injection attacks. Further exploits are possible but have not been verified.

Mitigation:
        Apache OpenOffice users are advised to upgrade to Apache OpenOffice 4.1.1. Users who are unable to upgrade immediately should be cautious when opening untrusted documents.

Credits:
	The Apache OpenOffice security team credits Rohan Durve and James Kettle of Context Information Security as the discoverer of this flaw.

Herbert Dürr
Member of the Apache OpenOffice Security Team
--- cut ---
Comment 1 Petr Mladek 2014-08-22 12:38:55 UTC 
More details were send to the Office security mailling list on Wed, 9 Jul 2014 12:00:27 +0100.
Unfortunately, the disclosure date has not been settled down at that time :-(

--- cut ---
Description:        LibreOffice CSV Command Injection
Versions Affected:  LibreOffice Calc 4.1.6
Category:           Command Injection
Credit:             Rohan Durve and James Kettle of Context Information Security 

Summary:
--------

Comma Seperated Value (CSV) formatted documents opened in LibreOffice Calc (under a Microsoft Windows operating environment) execute arbitrary formulae before prompting for the appropr
iate security permissions. Injecting a Dynamic Data Exchange (DDE) formula permits an attacker to execute arbitrary commands from within the application with the active user’s privileg
es.

Note, this issue also affects other branches of OpenOffice and has been reported to their respective security teams.

Analysis:
---------

Upon openning a DDE formula embedded CSV file in Calc on Microsoft windows the formulae are executed before prompting for the appropiate security permissions. This can be exploited to 
execute arbitrary applications from vulnerable versions of Calc without prompting the user.

The syntax for the DDE formula used for command injection is:
    =(server; file; item; mode)

Wherein, the file may be substituted as program arguments:
    =DDE("cmd";"/C calc";"__DdeLink_60_870516294")

However, in order for this to be stored into a single .CSV cell without breaking, the following encoding is required. (Refer to RFC4180 for further information.)
    "=DDE(""cmd"";""/C calc"";""__DdeLink_60_870516294"")"
    
Proof of Concept:
-----------------

The following CSV file, when openned with Calc on Microsoft Windows will execute the built-in Windows calculator application:
    Alpha;Beta;Charlie;Delta;Echo;Foxtrot;Golf;Hotel;India
    A;B;C;D;E;F;G;"=DDE(""cmd"";""/C calc"";""__DdeLink_60_870516294"")"

It should be noted that in order for this to sucessfully executed, the file must be openned with a .csv file extension.
--- cut ---
Comment 3 Petr Mladek 2014-08-22 12:47:47 UTC 
The issue is kind of public but full details have not been disclosed yet. Any disclosure date has not been defined yet.

Upstream LibreOffice is going to release extra bugfix releases ASAP.

It seems that all older LO versions are affected. It means that we need to put the fix into:
     SLE11-SP3
     SLE12
     all supported openSUSE releases.
Comment 4 Alexander Bergmann 2014-08-22 13:12:56 UTC 
Hmm, it looks like this doesn't affect Linux at all.

"(under a Microsoft Windows operating environment)"

I've tested the proof of concept under openSUSE:12.3, 13.1 and SLED-11-SP2 and I'm always getting a pop-up dialog window asking "This file contains links to other files. Should they be updated? [Yes][No]".

Petr, please double check.


LibreOffice Versions: 

openSUSE:12.3: libreoffice-calc-3.6.3.2.4
openSUSE:13.1: libreoffice-calc-4.1.6.2
SLED-11-SP2:   libreoffice-calc-3.6.5.2.15
Comment 5 Petr Mladek 2014-08-22 14:01:58 UTC 
Alexander, great catch!

First, all the changes mentioned in the comment #2 affect only the code inside #if defined(WNT).
Second, the command was evidently executed by this Windows-specific line:

     if( WinExec( aCmdLine.getStr(), SW_SHOWMINIMIZED ) < 32 )

So, you are right. This bug is Windows-specific.

I have added Andras Timar from Collabora into CC. They are preparing updates for "LibreOffice for Windows" product for us.
Comment 6 Swamp Workflow Management 2014-08-22 22:00:37 UTC 
bugbot adjusting priority
Comment 9 Bernhard Wiedemann 2014-09-03 15:00:11 UTC 
This is an autogenerated message for OBS integration:
This bug (893133) was mentioned in
https://build.opensuse.org/request/show/247428 Factory / libreoffice
Comment 10 Johannes Segitz 2015-03-24 16:45:33 UTC 
so if this is windows only then we can close it