CVE-2014-3693: LibreOffice Impress Remote can crash or be hijacked

Summary

Older versions of LibreOffice Impress Remote (before 4.2.7 or 4.3.3) can be attacked over the network. An attacker who can reach the computer can send a specially crafted message to network port 1599, causing the program to crash or, in some cases, run the attacker’s code. Update LibreOffice to the latest version or block port 1599 to protect your systems.

What to do

Update debian libreoffice to version 1:4.3.3~rc2~git20141011-1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:11	debian	libreoffice	< 1:4.3.3~rc2~git20141011-1 Fix: upgrade to 1:4.3.3~rc2~git20141011-1
Debian:12	debian	libreoffice	< 1:4.3.3~rc2~git20141011-1 Fix: upgrade to 1:4.3.3~rc2~git20141011-1
Debian:13	debian	libreoffice	< 1:4.3.3~rc2~git20141011-1 Fix: upgrade to 1:4.3.3~rc2~git20141011-1
Debian:14	debian	libreoffice	< 1:4.3.3~rc2~git20141011-1 Fix: upgrade to 1:4.3.3~rc2~git20141011-1
–	redhat	enterprise_linux_desktop	7.0 `cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:::::::*`
–	redhat	enterprise_linux_server	7.0 `cpe:2.3:o:redhat:enterprise_linux_server:7.0:::::::*`
–	redhat	enterprise_linux_workstation	7.0 `cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:::::::*`
–	canonical	ubuntu_linux	14.04 14.10 `cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::`
–	libreoffice	libreoffice	4.0.0 4.0.1 4.0.2 4.0.3 4.0.3.3 4.0.4.2 4.1.0 4.1.1 4.1.2 4.1.3 4.1.4 4.2.0 9 more version ranges `cpe:2.3:a:libreoffice:libreoffice:4.0.0:::::::*`
–	opensuse	opensuse	13.1 `cpe:2.3:o:opensuse:opensuse:13.1:::::::*`

Original advisory text

Use-after-free vulnerability in the socket manager of Impress Remote in LibreOffice 4.x before 4.2.7 and 4.3.x before 4.3.3 allows remote attackers to cause a denial of service (crash) or possibly ...

Use-after-free vulnerability in the socket manager of Impress Remote in LibreOffice 4.x before 4.2.7 and 4.3.x before 4.3.3 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted request to TCP port 1599.

References

https://security-tracker.debian.org/tracker/CVE-2014-3693 Vendor Advisory
http://lists.opensuse.org/opensuse-updates/2014-11/msg00049.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-0377.html Third Party Advisory
http://secunia.com/advisories/62111
http://secunia.com/advisories/62132
http://secunia.com/advisories/62396
http://www.securityfocus.com/bid/71351
http://www.ubuntu.com/usn/USN-2398-1 Patch Third Party Advisory
https://security.gentoo.org/glsa/201603-05
https://www.libreoffice.org/about-us/security/advisories/CVE-2014-3693/ Vendor Advisory