libreoffice openoffice bug allows hackers spoof

#Libreoffice openoffice bug allows hackers spoof upgrade#
#Libreoffice openoffice bug allows hackers spoof software#
#Libreoffice openoffice bug allows hackers spoof download#

If updating to the latest version is not possible for any reason, you can always opt to completely disable the macro features on your office suite, or avoid trusting any documents containing macros.

#Libreoffice openoffice bug allows hackers spoof download#

If you’re using Linux and the aforementioned versions aren’t available on your distribution's package manager yet, you are advised to download the “deb”, or “rpm” package from the Download center or build LibreOffice from source. Since neither of these two applications offer auto-updating, you should do it manually by downloading the latest version from the respective download centers - LibreOffice, OpenOffice. For OpenOffice, that would be 4.1.10 and later, and for LibreOffice, 7.0.5 or 7.1.1 and later.

#Libreoffice openoffice bug allows hackers spoof upgrade#

If you’re using either of the open-source office suites, you’re advised to upgrade to the latest available version immediately. The same flaw impacts LibreOffice, which is a fork of OpenOffice spawned from the main project over a decade ago, and for their project is tracked as CVE-2021-25635. The discovery of the flaw, which is tracked as CVE-2021-41832 for OpenOffice, was the work of four researchers at the Ruhr University Bochum. 'Allowing anyone to sign macro-ridden documents themselves, and make them appear as trustworthy, is an excellent way to trick users into running malicious code. The digital signatures used in document macros are meant to help the user verify that the document hasn’t been altered and can be trusted. Again if you use either suite be sure you upgrade to the latest version as soon as possible.LibreOffice and OpenOffice have pushed updates to address a vulnerability that makes it possible for an attacker to manipulate documents to appear as signed by a trusted source.Īlthough the severity of the flaw is classified as moderate, the implications could be dire. It should be noted that neither of these applications are auto-updating. That means that this flaw has roots that run deep. An offshoot that was created decades ago. For those who don't know LibreOffice is a fork of OpenOffice. Kudos to the developers for quickly addressing these security issues. The OpenOffice flaw is being tracked as CVE-2021-41832 and the LibreOffice flaw is being tracked as CVE-2021-25635. This is because an invalid signature algorithm could still make a laced document appear as it comes from a trusted source. Also note that if you are running an older version you shouldn't rely on the 'trusted list' functionality. If you are unable to upgrade whatever the reason a viable temporary solution would be to disable macros. Given the risks that these security flaws represent you should upgrade to the latest version as soon as possible. That means that unless you're very good about checking for new versions on a regular basis the version you're currently using is probably out of date.

The OpenOffice flaw is being tracked as CVE-2021-41832 and the LibreOffice flaw is being tracked as CVE-2021-25635. As such the ability to spoof those signatures could easily open the floodgates allowing attackers to do untold harm to any business using either Libre- or OpenOffice.

Digital signatures are used as a means of verifying that the document in question is from a trusted source. This vulnerability allows an attacker to modify and manipulate documents so that it appears they have been signed by a trusted party.Īlthough the flaw that makes this possible has only been classified 'Moderate' the reality is that the implications could be crippling.

#Libreoffice openoffice bug allows hackers spoof software#

The maintainers of LibreOffice and OpenOffice have shipped security updates to their productivity software to remediate multiple vulnerabilities that could be weaponized by malicious actors to alter documents to make them appear as if. Do you use LibreOffice or OpenOffice? If so be aware that security updates have recently been issued due to the recent discovery of a major security flaw. Digital Signature Spoofing Flaws Uncovered in OpenOffice and LibreOffice.