StarSuite 8 (Solaris): Update 18.
Date this patch was last updated by Sun : Mar/15/11

StarOffice 8 (Solaris_x86): Update 14.
Date this patch was last updated by Sun : Sep/10/09

This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575)

The remote host is affected by the vulnerability described in GLSA-200712-25 (OpenOffice.org: User-assisted arbitrary code execution)

    The HSQLDB engine, as used in Openoffice.org, does not properly enforce     restrictions to SQL statements.
  Impact :

    A remote attacker could entice a user to open a specially crafted     document, possibly resulting in the remote execution of arbitrary Java     code with the privileges of the user running OpenOffice.org.
  Workaround :

    There is no known workaround at this time.

Updated openoffice.org and hsqldb packages that fix security flaws are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

OpenOffice.org is an office productivity suite. HSQLDB is a Java relational database engine used by OpenOffice.org Base.

It was discovered that HSQLDB could allow the execution of arbitrary public static Java methods. A carefully crafted odb file opened in OpenOffice.org Base could execute arbitrary commands with the permissions of the user running OpenOffice.org. (CVE-2007-4575)

It was discovered that HSQLDB did not have a password set on the 'sa' user. If HSQLDB has been configured as a service, a remote attacker who could connect to the HSQLDB port (tcp 9001) could execute arbitrary SQL commands. (CVE-2003-0845)

Note that in Red Hat Enterprise Linux 5, HSQLDB is not enabled as a service by default, and needs manual configuration in order to work as a service.

Users of OpenOffice.org or HSQLDB should update to these errata packages which contain backported patches to correct these issues.

Updated openoffice.org2 packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

OpenOffice.org is an office productivity suite. HSQLDB is the default database engine shipped with OpenOffice.org 2.

It was discovered that HSQLDB could allow the execution of arbitrary public static Java methods. A carefully crafted odb file opened in OpenOffice.org Base could execute arbitrary commands with the permissions of the user running OpenOffice.org. (CVE-2007-4575)

All users of OpenOffice.org are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue.

CVE-2007-4575 restrict java instantiation features of hsqldb

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
107356	Solaris 10 (sparc) : 120189-23	Nessus	Solaris Local Security Checks	2018/3/12	2025/10/24	high
22993	Solaris 5.10 (x86) : 120186-19	Nessus	Solaris Local Security Checks	2006/11/6	2021/1/14	high
29368	SuSE 10 Security Update : OpenOffice_org (ZYPP Patch Number 4770)	Nessus	SuSE Local Security Checks	2007/12/13	2021/1/14	high
29822	GLSA-200712-25 : OpenOffice.org: User-assisted arbitrary code execution	Nessus	Gentoo Local Security Checks	2007/12/31	2021/1/6	high
43661	CentOS 5 : openoffice.org / hsqldb (CESA-2007:1048)	Nessus	CentOS Local Security Checks	2010/1/6	2021/1/4	high
29235	RHEL 4 : openoffice.org2 (RHSA-2007:1090)	Nessus	Red Hat Local Security Checks	2007/12/7	2021/1/14	high
29240	openSUSE 10 Security Update : OpenOffice_org (OpenOffice_org-4769)	Nessus	SuSE Local Security Checks	2007/12/7	2021/1/14	high
29274	Fedora 8 : openoffice.org-2.3.0-6.7.fc8 (2007-4172)	Nessus	Fedora Local Security Checks	2007/12/11	2021/1/11	high
63845	RHEL 5 : openoffice.org, hsqldb (RHSA-2007:1048)	Nessus	Red Hat Local Security Checks	2013/1/24	2021/1/14	high

检测

插件搜索

high

high

high

high

high

high

high

high

high