Vulnerability CVE-2010-0136

Vulnerability Name:

CVE-2010-0136 (CCN-56266)

Assigned:

2010-02-15

Published:

2010-02-15

Updated:

2022-02-07

Summary:

OpenOffice.org (OOo) 2.0.4, 2.4.1, and 3.1.1 does not properly enforce Visual Basic for Applications (VBA) macro security settings, which allows remote attackers to run arbitrary macros via a crafted document.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.2 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

CWE-77

Vulnerability Consequences:

Bypass Security

References:

Source: MITRE
Type: CNA
CVE-2010-0136

Source: SUSE
Type: Third Party Advisory
SUSE-SA:2010:017

Source: SECUNIA
Type: Broken Link
38695

Source: SECUNIA
Type: Broken Link
38921

Source: CCN
Type: SECTRACK ID: 1023588
OpenOffice VBA Macro Security Controls Can Be Bypassed

Source: SECTRACK
Type: Broken Link, Third Party Advisory, VDB Entry
1023588

Source: DEBIAN
Type: Third Party Advisory
DSA-1995

Source: DEBIAN
Type: DSA-1995
openoffice.org -- several vulnerabilities

Source: MLIST
Type: Mailing List, Third Party Advisory
[debian-openoffice] 20100212 ./packages/openofficeorg/3.1.1/unstable r1866: merge 1:3.1.1-15+squeeze1

Source: MANDRIVA
Type: Broken Link
MDVSA-2010:221

Source: CCN
Type: OpenOffice Web Site
OpenOffice.org - The Free and Open Productivity Suite

Source: CCN
Type: OSVDB ID: 62398
OpenOffice.org (OOo) VBA Security Setting Weakness Arbitrary Macro Execution

Source: BID
Type: Broken Link, Third Party Advisory, VDB Entry
38245

Source: CCN
Type: BID-38245
OpenOffice VBA Macro Restrictions Remote Security Bypass Vulnerability

Source: CCN
Type: USN-903-1
OpenOffice.org vulnerabilities

Source: UBUNTU
Type: Third Party Advisory
USN-903-1

Source: VUPEN
Type: Broken Link
ADV-2010-0635

Source: VUPEN
Type: Broken Link
ADV-2010-2905

Source: XF
Type: UNKNOWN
openoffice-vba-sec-bypass(56266)

Source: SUSE
Type: SUSE-SA:2010:017
OpenOffice.org security update

Vulnerable Configuration:

Configuration 1:

cpe:/a:apache:openoffice:2.0.4:*:*:*:*:*:*:*

OR cpe:/a:apache:openoffice:2.4.1:*:*:*:*:*:*:*

OR cpe:/a:apache:openoffice:3.1.1:*:*:*:*:*:*:*

Configuration 2:

cpe:/o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*

OR cpe:/o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*

OR cpe:/o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*

OR cpe:/o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:*

OR cpe:/o:debian:debian_linux:4.0:*:*:*:*:*:*:*

OR cpe:/o:debian:debian_linux:5.0:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:20100136	V	CVE-2010-0136	2017-09-27
oval:org.mitre.oval:def:13500	P	USN-903-1 -- openoffice.org vulnerabilities	2014-06-30
oval:org.mitre.oval:def:6910	P	DSA-1995 openoffice.org -- several vulnerabilities	2014-06-23
oval:org.mitre.oval:def:12661	P	DSA-1995-1 openoffice.org -- several	2014-06-23
oval:org.debian:def:1995	V	several vulnerabilities	2010-02-12

BACK