LibreOffice, OpenOffice bug allows hackers to spoof signed docs

guest · Oct 11, 2021

LibreOffice, OpenOffice bug allows hackers to spoof signed docs
October 11, 2021
https://www.bleepingcomputer.com/ne...fice-bug-allows-hackers-to-spoof-signed-docs/

LibreOffice and OpenOffice have pushed updates to address a vulnerability that makes it possible for an attacker to manipulate documents to appear as signed by a trusted source.

Although the severity of the flaw is classified as moderate, the implications could be dire. The digital signatures used in document macros are meant to help the user verify that the document hasn’t been altered and can be trusted.

"Allowing anyone to sign macro-ridden documents themselves, and make them appear as trustworthy, is an excellent way to trick users into running malicious code.
Click to expand...

The discovery of the flaw, which is tracked as CVE-2021-41832 for OpenOffice, was the work of four researchers at the Ruhr University Bochum.

The same flaw impacts LibreOffice, which is a fork of OpenOffice spawned from the main project over a decade ago, and for their project is tracked as CVE-2021-25635.
Click to expand...

If you’re using either of the open-source office suites, you’re advised to upgrade to the latest available version immediately. For OpenOffice, that would be 4.1.10 and later, and for LibreOffice, 7.0.5 or 7.1.1 and later.

If updating to the latest version is not possible for any reason, you can always opt to completely disable the macro features on your office suite, or avoid trusting any documents containing macros.
To set macro security on LibreOffice, go to Tools → Options → LibreOffice → Security, and click on ‘Macro Security’.
Click to expand...

Log in or Sign up

LibreOffice, OpenOffice bug allows hackers to spoof signed docs

guest Guest

Log in or Sign up

LibreOffice, OpenOffice bug allows hackers to spoof signed docs

guest Guest

Useful Searches