Уязвимость обхода защиты и выполнения произвольных Python-команд через сценарии LibreLogo в LibreOffice
Описание
LibreOffice обычно поставляется с LibreLogo, программируемым скриптом для векторной графики на основе "черепашки" (turtle graphics), который может выполнять произвольные команды Python, содержащиеся в документе, из которого он был запущен. LibreOffice также имеет функцию, позволяющую документам указывать выполнение предустановленных скриптов при различных событиях, таких как наведение мыши и другие. Для устранения уязвимости CVE-2019-9848 была добавлена защита, блокирующая вызовы LibreLogo из обработчиков событий скриптов. Однако уязвимость, связанная с недостаточной проверкой URL, позволила злоумышленникам обойти эту защиту и снова активировать вызовы LibreLogo из обработчиков событий скриптов.
Затронутые версии ПО
- Document Foundation LibreOffice версии до 6.2.6
Тип уязвимости
- Выполнение произвольного кода
- Обход защиты
Ссылки
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Third Party Advisory
- Third Party Advisory
- Vendor Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Third Party Advisory
- Third Party Advisory
- Vendor Advisory
Уязвимые конфигурации
Одно из
EPSS
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
Связанные уязвимости
LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. LibreOffice also has a feature where documents can specify that pre-installed scripts can be executed on various document script events such as mouse-over, etc. Protection was added, to address CVE-2019-9848, to block calling LibreLogo from script event handers. However an insufficient url validation vulnerability in LibreOffice allowed malicious to bypass that protection and again trigger calling LibreLogo from script event handlers. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.
LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. LibreOffice also has a feature where documents can specify that pre-installed scripts can be executed on various document script events such as mouse-over, etc. Protection was added, to address CVE-2019-9848, to block calling LibreLogo from script event handers. However an insufficient url validation vulnerability in LibreOffice allowed malicious to bypass that protection and again trigger calling LibreLogo from script event handlers. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.
LibreOffice is typically bundled with LibreLogo, a programmable turtle ...
LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. LibreOffice also has a feature where documents can specify that pre-installed scripts can be executed on various document script events such as mouse-over, etc. Protection was added, to address CVE-2019-9848, to block calling LibreLogo from script event handers. However an insufficient url validation vulnerability in LibreOffice allowed malicious to bypass that protection and again trigger calling LibreLogo from script event handlers. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.
Уязвимость программного модуля LibreLogo пакета офисных программ LibreOffice, позволяющая нарушителю выполнить произвольный код в целевой системе
EPSS
9.8 Critical
CVSS3
7.5 High
CVSS2