Digital Signature Spoofing Flaws Uncovered in OpenOffice and LibreOffice
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-25633 | LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since t LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to create a digitally signed ODF document, by manipulating the documentsignatures.xml or macrosignatures.xml stream within the document to combine multiple certificate data, which when opened caused LibreOffice to display a validly signed indicator but whose content was unrelated to the signature shown. This issue affects: The Document Foundation LibreOffice 7-0 versions prior to 7.0.6; 7-1 versions prior to 7.1.2. NVD description · AI analysis pending | 7.5 | <1% |
| — | ||
| CVE-2021-25634 | LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since t LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to modify a digitally signed ODF document to insert an additional signing time timestamp which LibreOffice would incorrectly present as a valid signature signed at the bogus signing time. This issue affects: The Document Foundation LibreOffice 7-0 versions prior to 7.0.6; 7-1 versions prior to 7.1.2. NVD description · AI analysis pending | 7.5 | <1% |
| — | ||
| CVE-2021-25635 | An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to self sign an ODF document, with a signature untrusted by the target, then An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to self sign an ODF document, with a signature untrusted by the target, then modify it to change the signature algorithm to an invalid (or unknown to LibreOffice) algorithm and LibreOffice would incorrectly present such a signature with an unknown algorithm as a valid signature issued by a trusted person This issue affects LibreOffice: from 7.0 before 7.0.5, from 7.1 before 7.1.1. NVD description · AI analysis pending | 5.2 | <1% |
| — | ||
| CVE-2021-41830 | It is possible for an attacker to manipulate signed documents and macros to appear to come from a trusted source. It is possible for an attacker to manipulate signed documents and macros to appear to come from a trusted source. All versions of Apache OpenOffice up to 4.1.10 are affected. Users are advised to update to version 4.1.11. See CVE-2021-25633 for the LibreOffice advisory. NVD description · AI analysis pending | 7.5 group max | 1% |
| — |
Full article324 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananOct 12, 2021
The maintainers of LibreOffice and OpenOffice have shipped security updates to their productivity software to remediate multiple vulnerabilities that could be weaponized by malicious actors to alter documents to make them appear as if they are digitally signed by a trusted source.
The list of the three flaws is as follows —
- CVE-2021-41830 / CVE-2021-25633 - Content and Macro Manipulation with Double Certificate Attack
- CVE-2021-41831 / CVE-2021-25634 - Timestamp Manipulation with Signature Wrapping
- CVE-2021-41832 / CVE-2021-25635 - Content Manipulation with Certificate Validation Attack
Successful exploitation of the vulnerabilities could permit an attacker to manipulate the timestamp of signed ODF documents, and worse, alter the contents of a document or self-sign a document with an untrusted signature, which is then tweaked to change the signature algorithm to an invalid or unknown algorithm.
In both the latter two attack scenarios — stemming as a result of improper certificate validation — LibreOffice incorrectly displays a validly signed indicator suggesting that the document hasn't been tampered with since signing and presents a signature with an unknown algorithm as a legitimate signature issued by a trusted party.
The weaknesses have been fixed in OpenOffice version 4.1.11 and LibreOffice versions 7.0.5, 7.0.6, 7.1.1 as well as 7.1.2. The Chair for Network and Data Security (NDS) at the Ruhr-University Bochum has been credited with discovering and reporting all three issues.
The findings are the latest in a series of flaws uncovered by the Ruhr-University Bochum researchers and follow similar attack techniques disclosed earlier this year that could potentially enable an adversary to modify a certified PDF document's visible content by displaying malicious content over the certified content without invalidating its signature.
Users of LibreOffice and OpenOffice are advised to update to the latest version to mitigate the risk associated with the flaws.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2021/10/digital-signature-spoofing-flaws.html