It is thought that no working exploit for the flaws exists in the wild

OpenOffice users urged to apply security fixes

Patches address a pair of critical flaws

vnunet.com, 31 Oct 2008

A pair of security fixes have been posted for OpenOffice.

Users are being urged to install both updates, which address flaws in the open-source productivity suite that could be used by an attacker to remotely execute code on targeted systems.

Both vulnerabilities affect all versions of OpenOffice prior to the 2.4.2 release. The recently-unveiled OpenOffice 3.0 release is not believed to be at risk from either vulnerability.

The flaws centre on the way OpenOffice handles certain file types. An attacker could use a specially-crafted WMF or EMF file to cause a heap overflow error that would then leave the attacker able to execute malicious code on the targeted system.

No working exploit for either vulnerability is thought to exist in the wild. Credit for the discovery of both flaws was given to an anonymous researcher operating out of Chinese security firm SureRun.

The French Security Incident Response Team (FrSIRT) has rated both flaws as critical, the highest of its four alert levels. Both FrSIRT and the US Computer Emergency Response Team are advising users to update their copies of OpenOffice to remove the vulnerabilities.