CVE-2010-3450: Path Traversal
Multiple directory traversal vulnerabilities in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allow remote attackers to overwrite arbitrary files via a .. (dot dot) in an entry in (1) an XSLT JAR filter description file, (2) an Extension (aka OXT) file, or unspecified other (3) JAR or (4) ZIP files.
Other sources
Originally Marc Schoenefeld found a directory traversal flaw in the way OpenOffice.org prior to v3.2.1 handled XSLT jar filter description files installation. If a local user was tricked to install a specially-crafted OOo XSLT jar filter description file, it could allow remote attackers to create or overwrite arbitrary files belonging to local user or, potentially, execute arbitrary code via a .. (dot dot) in an entry in a XSLT filter description file.
Later, OpenOffice.org upstream identified the same deficiency in the way OOs Extension Manager performed installation of OpenOffice.org Extension (.OXT) files.
References: [1] http://extensions.services.openoffice.org/en/resources [2] http://wiki.services.openoffice.org/wiki/Documentation/DevGuide/Extensions/Extensions
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3450?
The severity of CVE-2010-3450 is classified as moderate, as it allows remote attackers to overwrite arbitrary files.
How do I fix CVE-2010-3450?
To fix CVE-2010-3450, upgrade to OpenOffice.org version 3.3 or later, which addresses these vulnerabilities.
Which versions of OpenOffice.org are affected by CVE-2010-3450?
CVE-2010-3450 affects OpenOffice.org versions 2.x and 3.x prior to version 3.3.
What types of files are vulnerable in CVE-2010-3450?
CVE-2010-3450 allows exploitation through multiple file types, including XSLT JAR filter description files, OXT files, and other JAR or ZIP files.
What kind of impact can CVE-2010-3450 have on users?
CVE-2010-3450 can lead to unauthorized data manipulation by allowing attackers to overwrite files on the user's system.