Unscored CVE-2008-3437 EUVD-2008-3423GHSA-3g32-62rm-7wvw

OpenOffice.org (OOo) before 2.1.0 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute…

Published Aug 1, 2008 · Updated Sep 16, 2024 · Assigned by mitre

Description

OpenOffice.org (OOo) before 2.1.0 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.

References

http://www.infobyte.com.ar/down/Francisco%20Amato%20-%20evilgrade%20-%20ENG.pdf
http://www.infobyte.com.ar/down/isr-evilgrade-1.0.0.tar.gz
1020583 vdb-entry
20080728 Tool release: [evilgrade] - Using DNS cache poisoning to exploit poor update implementations mailing-list