oss-security - Re: Remote file inclusion by office applications

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <50CA243D.9040900@fifthhorseman.net>
Date: Thu, 13 Dec 2012 13:53:49 -0500
From: Daniel Kahn Gillmor <dkg@...thhorseman.net>
To: oss-security@...ts.openwall.com
CC: Kurt Seifried <kseifried@...hat.com>, Timo Warns <Warns@...-Sense.DE>
Subject: Re: Remote file inclusion by office applications

On 12/13/2012 11:44 AM, Kurt Seifried wrote:
> I'm kind of leaning towards classifying this as a security issue since
> I expected there is some way to disable it or at least tell it to
> prompt me when a document tries to go get an external data source
> (e.g. "this document contains external data, the URLs/file paths it is
> trying to  reference are: [list of locations]") but apparently there
> is no way to disable/have this prompt (at least that I can find in
> LibreOffice)?

I think your assessment is correct.  I've just now made an ODT file that
libreoffice uses to not only hit the network for a PNG (denial of
service attacks, remote exploitation of other flaws in libpng or in LO
itself, virus scanner bypass, etc), but one that will include and render
~/.ssh/id_rsa as a text/plain document.  This seems like it could be
done against any local privileged file.

For local file inclusion, libreoffice at leasts prompts me with:

-----------
 This document contains one or more links to external data.

 Would you like to change the document, and update all links to get the
 most recent data?

 [Yes] [No]
-----------

but it doesn't tell me what those documents are. And given the UI
history of people clicking through popups they don't understand, i'm not
convinced that this popup is going to do anything to prevent remote
disclosure (it even defaults to "Yes").  When i say "no" on the prompt,
it goes out and fetches networked URLs anyway, so i assume this prompt
is supposed to just refer to local "external data".

	--dkg

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.