Category Archives: Advisories

Advisories

USN-5694-1: LibreOffice vulnerabilities

Read Time:1 Minute, 6 Second

It was discovered that LibreOffice incorrectly handled links using the
Office URI Schemes. If a user were tricked into opening a specially
crafted document, a remote attacker could use this issue to execute
arbitrary scripts. (CVE-2022-3140)

Thomas Florian discovered that LibreOffice incorrectly handled crashes when
an encrypted document is open. If the document is recovered upon restarting
LibreOffice, subsequent saves of the document were unencrypted. This issue
only affected Ubuntu 18.04 LTS. (CVE-2020-12801)

Jens Müller discovered that LibreOffice incorrectly handled certain
documents containing forms. If a user were tricked into opening a specially
crafted document, a remote attacker could overwrite arbitrary files when
the form was submitted. This issue only affected Ubuntu 18.04 LTS.
(CVE-2020-12803)

It was discovered that LibreOffice incorrectly validated macro signatures.
If a user were tricked into opening a specially crafted document, a remote
attacker could possibly use this issue to execute arbitrary macros. This
issue only affected Ubuntu 18.04 LTS. (CVE-2022-26305)

It was discovered that Libreoffice incorrectly handled encrypting the
master key provided by the user for storing passwords for web connections.
A local attacker could possibly use this issue to obtain access to
passwords stored in the user’s configuration data. This issue only affected
Ubuntu 18.04 LTS. (CVE-2022-26306, CVE-2022-26307)

Read More

Advisories

Newly Disclosed Vulnerability in Apache Commons Text Alllows for RCE (CVE-2022-42889)

Read Time:1 Minute, 58 Second

FortiGuard Labs is aware of reports of a recent vulnerability in Apache Commons, which allows for remote code execution. Assigned, CVE-2022-42889, Apache Commons Text prior to 1.10.0 allows remote code execution (RCE) when applied to untrusted input due to insecure interpolation defaults.What are the Details of this Vulnerability?According to Apache, version 1.5 and 1.9 of Apache Commons are affected. Apache Commons suffers from default Lookup instance where included interpolators could result in arbitrary code execution or contact with remote servers. These lookups are: – “script” – execute expressions using the JVM script execution engine (javax.script) – “dns” – resolve dns records – “url” – load values from urls, including from remote servers.Applications using the defalts in versions 1.5 and 1.9 may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the default interpolators.Have there been Reports of Exploitation in the Wild?No. There have been no instances reported in the wild according to Apache. This is likely due to unique niche setups and the specific parameters required to successfully exploit this vulnerability.What is the CVSS Score?9.8 CRITICALThere are Reports that this is Similar to Log4Shell, hence the Designation #Text4Shell. Along with the CVSS Score of 9.8 is there Reason for Concern?Reports of this issue appear to be minimal, with no evidence at this time of active exploitation or wide install base similar to the Log4Shell event. This is due to the niche usage of Apache Commons and specific parameters that must be passed to successfully leverage this vulnerability. A small subset of open source programs have been observed using the parameters but those that are do not accept user defined parameters, which should limit the amount of exploitation attempts.Any Recommended Mitigation?It is suggested to upgrade to Apache Commons Text 1.10.0 as soon as time permits. If this is not possible, it is suggested that all internet facing sites running vulnerable versions of Apache Commons Text are put behind a firewall or removed from the public facing internet.What is the Status of AV/IPS Coverage?IPS signature development is currently being investigated and this Threat Signal will be updated when relevant information is available.

Read More