CVE-2010-0136: Command Injection
Published Feb 16, 2010
·Updated
OpenOffice.org (OOo) 2.0.4, 2.4.1, and 3.1.1 does not properly enforce Visual Basic for Applications (VBA) macro security settings, which allows remote attackers to run arbitrary macros via a crafted document.
Affected Software
9 affected components
Apache OpenOffice=2.0.4
Apache OpenOffice=2.4.1
Apache OpenOffice=3.1.1
Debian Debian Linux=5.0
Debian Debian Linux=4.0
Canonical Ubuntu Linux=9.04
Canonical Ubuntu Linux=8.10
Canonical Ubuntu Linux=9.10
Canonical Ubuntu Linux=8.04
Event History
Feb 16, 2010
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Data Sourced
via NVD·07:30 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2010-0136?
CVE-2010-0136 has a moderate severity level, allowing potential execution of arbitrary macros.
2
How do I fix CVE-2010-0136?
To fix CVE-2010-0136, update OpenOffice.org to the latest version that properly enforces VBA macro security settings.
3
Which versions of OpenOffice.org are affected by CVE-2010-0136?
CVE-2010-0136 affects OpenOffice.org versions 2.0.4, 2.4.1, and 3.1.1.
4
Can CVE-2010-0136 be exploited through crafted documents?
Yes, CVE-2010-0136 can be exploited when a user opens a crafted document that bypasses VBA macro security settings.
5
Is there a workaround for CVE-2010-0136 if I cannot update?
A potential workaround for CVE-2010-0136 is to disable VBA macros in OpenOffice.org until an update is applied.