Pierluigi Paganini July 28, 2022

LibreOffice maintainers addressed three security flaws in their productivity software, including an arbitrary code execution issue.

LibreOffice is an open-source office productivity software suite, a project of The Document Foundation (TDF).

LibreOffice maintainers addressed three security flaws in their suit, including an arbitrary code execution issue tracked as CVE-2022-26305. The CVE-2022-26305 flaw is classified as the execution of untrusted macros due to improper certificate validation. The issue could lead to the execution of malicious macros.

By default, LibreOffice executes macros only if they are stored in a trusted file location or if they are signed by a trusted certificate included in a list of certificates stored in the user’s configuration database.

“An Improper Certificate Validation vulnerability in LibreOffice existed where determining if a macro was signed by a trusted author was done by only matching the serial number and issuer string of the used certificate with that of a trusted certificate. This is not sufficient to verify that the macro was actually signed with the certificate.” reads the advisory published by LibreOffice. “An adversary could therefore create an arbitrary certificate with a serial number and an issuer string identical to a trusted certificate which LibreOffice would present as belonging to the trusted author, potentially leading to the user to execute arbitrary code contained in macros improperly trusted.”

This flaw cannot be exploited if the macro security level is set to very high or if the user has no trusted certificates.

The second issue fixed in the popular software is a static initialization vector that allows to recover passwords for Web Connections without knowing the master password.

“LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user.” reads the advisory. “A flaw in LibreOffice existed where the required initialization vector for encryption was always the same which weakens the security of the encryption making them vulnerable if an attacker has access to the user’s configuration data.”

The third issue addressed in the software, tracked as CVE-2022-26307, is related to the use of Weak Master Keys that could be guessed by attackers through a brute-force attack.

“LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user.” reads the advisory. “A flaw in LibreOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 to 43 bits making the stored passwords vulnerable to a brute force attack if an attacker has access to the users stored config.”

All the flaws were discovered by OpenSource Security GmbH on behalf of the German Federal Office for Information Security, they were fixed with the release of versions 7.2.7, 7.3.2, and 7.3.3.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, LibreOffice)

[adrotate banner=”5″]

[adrotate banner=”13″]