Vulnerability CVE-2006-2199

Vulnerability Name:

CVE-2006-2199 (CCN-27569)

Assigned:

2006-06-29

Published:

2006-06-29

Updated:

2018-10-18

Summary:

Unspecified vulnerability in Java Applets in OpenOffice.org 1.1.x (aka StarOffice) up to 1.1.5 and 2.0.x before 2.0.3 allows user-assisted attackers to escape the Java sandbox and conduct unauthorized activities via certain applets in OpenOffice documents.

CVSS v3 Severity:

9.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

7.6 High (CVSS v2 Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): High Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

7.6 High (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): High Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

CWE-noinfo

Vulnerability Consequences:

Bypass Security

References:

Source: MITRE
Type: CNA
CVE-2006-2199

Source: FEDORA
Type: UNKNOWN
FEDORA-2007-005

Source: CCN
Type: RHSA-2006-0573
openoffice.org security update

Source: CCN
Type: SA20867
OpenOffice Multiple Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
20867

Source: SECUNIA
Type: Vendor Advisory
20893

Source: SECUNIA
Type: Vendor Advisory
20910

Source: CCN
Type: SA20911
StarOffice / StarSuite Multiple Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
20911

Source: SECUNIA
Type: Vendor Advisory
20913

Source: SECUNIA
Type: Vendor Advisory
20975

Source: SECUNIA
Type: Vendor Advisory
20995

Source: SECUNIA
Type: Vendor Advisory
21278

Source: SECUNIA
Type: Vendor Advisory
23620

Source: GENTOO
Type: UNKNOWN
GLSA-200607-12

Source: CCN
Type: SECTRACK ID: 1016414
OpenOffice.org Bugs Let Java Scripts Escape the Sandbox, Macro Code Be Executed, or Arbitrary Code Be Executed on the Target System

Source: SECTRACK
Type: UNKNOWN
1016414

Source: CCN
Type: Sun Alert ID: 102475
Security Vulnerability With Java Applets in StarOffice/StarSuite

Source: SUNALERT
Type: UNKNOWN
102475

Source: CCN
Type: ASA-2006-134
openoffice.org security update (RHSA-2006-0573)

Source: DEBIAN
Type: UNKNOWN
DSA-1104

Source: DEBIAN
Type: DSA-1104
openoffice.org -- several vulnerabilities

Source: CCN
Type: GLSA-200607-12
OpenOffice.org: Multiple vulnerabilities

Source: CCN
Type: US-CERT VU#243681
OpenOffice.org may fail to properly contain certain Java applets

Source: CERT-VN
Type: US Government Resource
VU#243681

Source: MANDRIVA
Type: UNKNOWN
MDKSA-2006:118

Source: SUSE
Type: UNKNOWN
SUSE-SA:2006:040

Source: CCN
Type: OpenOffice.org Security Bulletin 2006-06-29
Security Bulletin 2006-06-29

Source: CONFIRM
Type: UNKNOWN
http://www.openoffice.org/security/CVE-2006-2199.html

Source: REDHAT
Type: UNKNOWN
RHSA-2006:0573

Source: BUGTRAQ
Type: UNKNOWN
20060926 rPSA-2006-0173-1 openoffice.org

Source: BID
Type: UNKNOWN
18737

Source: CCN
Type: BID-18737
OpenOffice Java Applet System Access Vulnerability

Source: CCN
Type: TLSA-2006-13
StarSuite 8 Product Update 3-2

Source: CCN
Type: USN-313-1
OpenOffice.org vulnerabilities

Source: UBUNTU
Type: UNKNOWN
USN-313-1

Source: CCN
Type: USN-313-2
OpenOffice.org vulnerabilities

Source: UBUNTU
Type: UNKNOWN
USN-313-2

Source: VUPEN
Type: Vendor Advisory
ADV-2006-2607

Source: VUPEN
Type: Vendor Advisory
ADV-2006-2621

Source: XF
Type: UNKNOWN
openoffice-applet-sandbox-bypass(27569)

Source: XF
Type: UNKNOWN
openoffice-applet-sandbox-bypass(27569)

Source: CONFIRM
Type: UNKNOWN
https://issues.rpath.com/browse/RPL-475

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:11338

Source: SUSE
Type: SUSE-SA:2006:040
OpenOffice_org security problems

Vulnerable Configuration:

Configuration 1:

cpe:/a:openoffice:openoffice:1.1.0:*:*:*:*:*:*:*

OR cpe:/a:openoffice:openoffice:1.1.1:*:*:*:*:*:*:*

OR cpe:/a:openoffice:openoffice:1.1.2:*:*:*:*:*:*:*

OR cpe:/a:openoffice:openoffice:1.1.3:*:*:*:*:*:*:*

OR cpe:/a:openoffice:openoffice:1.1.4:*:*:*:*:*:*:*

OR cpe:/a:openoffice:openoffice:1.1.5:*:*:*:*:*:*:*

OR cpe:/a:openoffice:openoffice:2.0.0:*:*:*:*:*:*:*

OR cpe:/a:openoffice:openoffice:2.0.1:*:*:*:*:*:*:*

OR cpe:/a:openoffice:openoffice:2.0.2:*:*:*:*:*:*:*

OR cpe:/a:sun:staroffice:6.0:*:*:*:*:*:*:*

OR cpe:/a:sun:staroffice:7.0:*:*:*:*:*:*:*

OR cpe:/a:sun:staroffice:8.0:*:*:*:*:*:*:*

Configuration RedHat 1:

cpe:/o:redhat:enterprise_linux:4:*:*:*:*:*:*:*

Configuration RedHat 2:

cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*

Configuration RedHat 3:

cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*

Configuration RedHat 4:

cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*

Configuration RedHat 5:

cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:20062199	V	CVE-2006-2199	2022-06-30
oval:org.opensuse.security:def:112807	P	libreoffice-7.1.5.2-3.13 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:106276	P	libreoffice-7.1.5.2-3.13 on GA media (Moderate)	2021-10-01
oval:org.mitre.oval:def:11338	V	Unspecified vulnerability in Java Applets in OpenOffice.org 1.1.x (aka StarOffice) up to 1.1.5 and 2.0.x before 2.0.3 allows user-assisted attackers to escape the Java sandbox and conduct unauthorized activities via certain applets in OpenOffice documents.	2013-04-29
oval:org.debian:def:1104	V	several vulnerabilities	2013-01-21
oval:com.redhat.rhsa:def:20060573	P	RHSA-2006:0573: openoffice.org security update (Important)	2008-03-20

BACK