PT-2019-3160 · Document Foundation+5 · Libreoffice+5

Nils Emmerich · Published 2019-08-06 · Updated 2022-11-03 · CVE-2019-9852

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Document Foundation LibreOffice versions prior to 6.2.6

Description The issue is related to the handling of URLs in LibreOffice, specifically with the LibreLogo module. It allows a remote attacker to execute arbitrary code on the target system using a specially crafted file. The vulnerability can be exploited by bypassing the protection added to address previous issues, using a URL encoding attack. This could lead to the execution of scripts in arbitrary locations on the file system.

Recommendations For versions prior to 6.2.6, update to version 6.2.6 or later to resolve the issue. As a temporary workaround, consider disabling the execution of scripts from event handlers to minimize the risk of exploitation. Restrict access to the LibreLogo module to prevent the execution of arbitrary code. Avoid using the LibreLogo script to execute commands from documents until the issue is resolved.

Exploit

Fix

Improper Encoding or Escaping of Output

RCE

Path traversal

Weakness Enumeration

CWE-116

CWE-20

CWE-22

Related Identifiers

ALT-PU-2019-2380

ALT-PU-2019-2402

ALT-PU-2019-2490

ALT-PU-2019-2500

ALT-PU-2019-2760

ALT-PU-2019-2761

BDU:2019-03149

CESA-2020_1151

CESA-2020_1598

CVE-2019-9852

DLA-1947-1

DSA-4501-1

DSA-4519-1

MGASA-2019-0340

OPENSUSE-SU-2019:2057-1

OPENSUSE-SU-2019:2183-1

OPENSUSE-SU-2019_2057-1

OPENSUSE-SU-2019_2183-1

RHSA-2020:1151

RHSA-2020:1598

RHSA-2020_1151

RHSA-2020_1598

SUSE-SU-2019:2231-1

SUSE-SU-2019:2401-1

SUSE-SU-2019:2402-1

USN-4102-1

Affected Products

Alt Linux

Centos

Libreoffice

Red Hat

Suse

Ubuntu

References · 127

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/fileformat/libreoffice_macro_exec.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/fileformat/libreoffice_logo_exec.rb · Exploit
• 🔥 https://github.com/4nimanegra/libreofficeExploit1 · Exploit
• https://linux.oracle.com/errata/ELSA-2020-1598.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9852 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2019:2402-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-9852 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2019:2057-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/PMEGUWMWORC3DOVEHVXLFT3A5RSCMLBH · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-03148 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-9852 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2019-2500 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2019-2402 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4102-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-9851 · Vendor Advisory