PT-2021-4126 · Apache · Apache Openoffice+1

Eugene Lim · Published 2021-09-17 · Updated 2021-12-01 · CVE-2021-33035

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache OpenOffice versions up to and including 4.1.10

Description The issue is related to the processing of DBF files in Apache OpenOffice. When reading DBF data, the size of certain fields is not checked, and the data is copied into local variables. A carefully crafted document could overflow the allocated space, leading to the execution of arbitrary code by altering the contents of the program stack. This allows a remote attacker to execute arbitrary code.

Recommendations For Apache OpenOffice versions up to and including 4.1.10, update to version 4.1.11 or later, which includes the patch for this issue. As a temporary workaround, consider avoiding the use of DBF files in Apache OpenOffice until the issue is resolved. Restrict access to the DBF file handling functionality to minimize the risk of exploitation.

Fix

Buffer Overflow

RCE

Weakness Enumeration

CWE-120

CWE-119

CWE-20

Related Identifiers

BDU:2021-04717

CVE-2021-33035

Affected Products

Apache Openoffice

Openoffice

References · 24

• https://github.com/apache/openoffice/commit/efddaef0151af3be16078cc4d88c6bae0f911e56#diff-ea66e734dd358922aba12ad4ba39c96bdc6cbde587d07dbc63d04daa0a30e90f · Patch
• https://cve.org/CVERecord?id=CVE-2021-33035 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-33035 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04717 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-33035 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-33035 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33035 · Vendor Advisory
• http://openwall.com/lists/oss-security/2021/10/07/3 · Patch
• https://ubuntu.com/security/CVE-2021-33035 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33035 · Security Note
• https://home.apache.org/~mseidel/AOO-builds/AOO-4111-Test/Full%20Installation · Note
• https://t.me/pentestingnews/11074 · Telegram Post
• https://t.me/cybersecuritytechnologies/4416 · Telegram Post
• https://t.me/cvenotify/22066 · Telegram Post
• https://twitter.com/spaceraccoonsec/status/1439282533137408002 · Note