CVE-2012-0037— OpenOffice.org敏感信息泄露漏洞

一分钟漏洞结论

复制摘要 复制引用

影响对象

n/a n/a

利用判断

利用概率较高，应尽快评估

建议动作

优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

OpenOffice.org（OOo）是美国阿帕奇（Apache）软件基金会的一款开源的办公软件套件。该套件包含文本文档、电子表格、演示文稿、绘图、数据库等。 OpenOffice.org中存在敏感信息泄露漏洞，此漏洞源于ODF文档内的某些XML组件在处理XML外部实体时的一个错误。攻击者可利用该漏洞通过特制XML实体，揭露ODF文档内的任意文件的内容。运行在Windows和Mac OS X上的OpenOffice.org 3.3版本中存在该漏洞，其他版本也可能受到影响。

CVE-2012-0037 影响 n/a n/a。利用概率较高，应尽快评估。OpenOffice.org（OOo）是美国阿帕奇（Apache）软件基金会的一款开源的办公软件套件。该套件包含文本文档、电子表格、演示文稿、绘图、数据库等。 OpenOffice.org中存在敏感信息泄露漏洞，此漏洞源于ODF文档内的某些XML组件在处理XML外部实体时的一个错误。攻击者可利用该漏洞通过特制XML实体，揭露ODF文档内的任意文件的内容。运行 CVE-2012-0037 漏洞详情，神龙漏洞库，https://cve.imfht.com/detail/CVE-2012-0037

一、 漏洞 CVE-2012-0037 基础信息

受影响产品

二、漏洞 CVE-2012-0037 的公开POC

三、漏洞 CVE-2012-0037 的情报信息

CVE-2012-0037 补丁与修复 (1)

• https://github.com/dajobe/raptor/commit/a676f235309a59d4aa78eeffd2574ae5d341fcb0 x_refsource_CONFIRM

CVE-2012-0037 厂商安全公告 (20)

• http://secunia.com/advisories/48494 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/48479 third-party-advisory x_refsource_SECUNIA
• http://www.osvdb.org/80307 vdb-entry x_refsource_OSVDB
• http://secunia.com/advisories/48649 third-party-advisory x_refsource_SECUNIA
• http://www.securityfocus.com/bid/52681 vdb-entry x_refsource_BID
• http://secunia.com/advisories/48493 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/48529 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/48526 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/50692 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/48542 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/60799 third-party-advisory x_refsource_SECUNIA
• http://www.securitytracker.com/id?1026837 vdb-entry x_refsource_SECTRACK
• http://www.debian.org/security/2012/dsa-2438 vendor-advisory x_refsource_DEBIAN
• http://security.gentoo.org/glsa/glsa-201209-05.xml vendor-advisory x_refsource_GENTOO
• http://rhn.redhat.com/errata/RHSA-2012-0410.html vendor-advisory x_refsource_REDHAT
• http://www.mandriva.com/security/advisories?name=MDVSA-2012:063 vendor-advisory x_refsource_MANDRIVA
• http://www.mandriva.com/security/advisories?name=MDVSA-2012:062 vendor-advisory x_refsource_MANDRIVA
• http://www.mandriva.com/security/advisories?name=MDVSA-2012:061 vendor-advisory x_refsource_MANDRIVA
• http://rhn.redhat.com/errata/RHSA-2012-0411.html vendor-advisory x_refsource_REDHAT
• https://exchange.xforce.ibmcloud.com/vulnerabilities/74235 vdb-entry x_refsource_XF

CVE-2012-0037 邮件列表归档 (4)

• http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077708.html vendor-advisory x_refsource_FEDORA
• http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078242.html vendor-advisory x_refsource_FEDORA
• http://www.openwall.com/lists/oss-security/2012/03/27/4 mailing-list x_refsource_MLIST
• https://lists.apache.org/thread.html/re0504f08000df786e51795940501e81a5d0ae981ecca68141e87ece0%40%3Ccommits.openoffice.apache.org%3E mailing-list x_refsource_MLIST

CVE-2012-0037 安全博客文章 (1)

• http://blog.documentfoundation.org/2012/03/22/tdf-announces-libreoffice-3-4-6/ x_refsource_CONFIRM

CVE-2012-0037 其他参考 (5)

• http://www.libreoffice.org/advisories/CVE-2012-0037/ x_refsource_CONFIRM
• http://www.openoffice.org/security/cves/CVE-2012-0037.html x_refsource_CONFIRM
• http://librdf.org/raptor/RELEASE.html#rel2_0_7 x_refsource_CONFIRM
• http://vsecurity.com/resources/advisory/20120324-1/ x_refsource_MISC
• http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml vendor-advisory x_refsource_GENTOO

• https://www.cve.org/CVERecord?id=CVE-2012-0037

同批安全公告 · n/a · 2012-06-17 · 共 13 条

IV. Related Vulnerabilities

V. Comments for CVE-2012-0037