Macro URL arbitrary script execution without warning
Fixed in Apache OpenOffice 4.1.14
Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose.Links can be activated by clicks, or by automatic document events. The execution of such links must be subject to user approval. In the affected versions of OpenOffice, approval for certain links is not requested; when activated, such links could therefore result in arbitrary script execution.
There are no known exploits of this vulnerability.
A proof-of-concept demonstration exists.
Thanks to the reporter for discovering this issue.
Vendor: The Apache Software Foundation
All Apache OpenOffice versions 4.1.13 and older are affected.
OpenOffice.org versions may also be affected.
Install Apache OpenOffice 4.1.14 for the latest maintenance and cumulative security fixes. Use the Apache OpenOffice download page.
The Apache OpenOffice Security Team would like to thank Altin Thartori (tin-z) and Joachim Mammele for discovering and reporting this attack vector.
The latest information on Apache OpenOffice security bulletins can be found at the Bulletin Archive page.