Pierluigi Paganini August 16, 2019

The latest version of LibreOffice (6.2.6/6.3.0) addresses three vulnerabilities that could be exploited by attackers to bypass patches for two previously addressed issues.

LibreOffice has released a new version of the popular open-source office software that addressed three vulnerabilities that could be exploited by attackers to bypass patches for two previously addressed issues.

LibreOffice attempted to fix one of the flaws, tracked as CVE-2019-9848, last month with the release of the version 6.2.5 that also addressed another issue (CVE-2019-9849).

The flaw resides in LibreLogo, a programmable turtle vector graphics script that ships by default with LibreOffice. LibreLogo allows users to specify pre-installed scripts in a document that can be executed when some events occur.

The flaw can be exploited by attackers using specially crafted malicious LibreOffice document files that can result in the silent execution of arbitrary python commands without displaying any warning to the victim.

The vulnerability was first discovered by security expert Nils Emmerich who explained that using forms and OnFocus event, it is even possible to execute arbitrary code when the document is opened, without the need for a mouse-over event.

Unfortunately, the patch did not completely address the issue, at least two separate security researchers found a way to bypass it and trigger the flaw again by exploiting the following 2 new vulnerabilities:

• CVE-2019-9850 vulnerability in LibreOffice exists due to insufficient URL validation that allows malicious attackers to bypass the patch initially developed for the CVE-2019-9848 and again trigger calling LibreLogo from script event handlers. The flaw was also discovered by Alex Inführ

• CVE-2019-9851 vulnerability resides in a separate feature where documents can specify pre-installed scripts, just like LibreLogo, which can be executed on various global script events such as document-open, etc. The vulnerability was discovered by the security researcher Gabriel Masei.

LibreOffice initially patched the CVE-2018-16858 in February, but it has successfully been bypassed by a directory traversal attack that could be exploited by an attacker to execute any script from arbitrary locations on the target’s file system.

• CVE-2019-9852 URL encoding attack could be exploited by attackers to bypass patch for directory traversal attack.

An attacker can chain the three vulnerabilities to remotely execute malicious commands on a targeted computer by tricking the victim into opening a maliciously-crafted document.

Don’t waste time, update your LibreOffice to the latest version.

Pierluigi Paganini

(SecurityAffairs – LibreOffice, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]