LibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Run Code Without Macro Warnings
-
Security researchers have demonstrated that a malicious spreadsheet can cause LibreOffice and Apache OpenOffice to execute an attacker's code the moment the file is opened. Unlike the macro warning dialog both suites normally display before running macro code, this execution path provides no warning at all.
The attack depends on the program's Java support being enabled — with Java disabled, the technique does not work. Researchers have so far only shown the attack as a proof of concept, and there are no reports of it being used in the wild.
Key points:
- Affected software: LibreOffice and Apache OpenOffice
- Trigger: opening a crafted spreadsheet
- No macro warning is displayed before code execution
- Java support must be enabled for the attack to succeed
- Status: proof of concept only, no known in-the-wild exploitation
Until patches or official guidance arrive, the most practical step for affected users is to disable Java support in the office suite if it is not required for their workflow.
Source: The Hacker News
Does your organization rely on Java support in LibreOffice or OpenOffice, and would disabling it be feasible in your environment?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login