Mailing-List: contact dev-help@openoffice.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@openoffice.apache.org
Reply-To: <dennis.hamilton@acm.org>
From: "Dennis E. Hamilton" <dennis.hamilton@acm.org>
To: <dev@openoffice.apache.org>
References: <57063A33.7040308@gmail.com>
In-Reply-To: <57063A33.7040308@gmail.com>
Subject: RE: Cross Script vulnerabilities in AOo Extensions?
Date: Thu, 7 Apr 2016 09:35:45 -0700
Organization: NuovoDoc
Message-ID: <008701d190eb$8ab0ec60$a012c520$@acm.org>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Thread-Index: AQHitNBaD/u+4g0Yn1a6S1ieprgKlZ9cVCew
Content-Language: en-us

Toki, thanks for your useful question.

Here are some factors to consider.

 1. The Apache OpenOffice project does not vet or review extensions and =
templates that are produced by third parties and downloadable from the =
SourceForge extension and template collections.  These are all "at your =
own risk."=20

 2. To the extent that extensions and templates operate at the privilege =
level of the OpenOffice user, it is possible for extension code to =
accomplish malicious purposes.

 3. There is no sandbox for the operation of extensions generally: =
access to the internet, the desktop platform, and file systems are not =
constrained.
=20
Basically, it does not require anything so elaborate as the bypassing of =
FireFox add-on protection described in the Ars Technica article.  =
Multi-component collaborative exploit staging is possible although =
unnecessary.

Part of the problem is that the extension format goes back to =
OpenOffice.org 1.x and a simpler world. =20

There is also complacency and mythology about OpenOffice not being =
vulnerable to some of the difficulties that arose in Microsoft Office =
software of the same and earlier eras.  It could be more the case that =
exploit perpetrators prefer to go where the most victims are to be =
found.  That does not mean other low-hanging fruit escapes attention, as =
we now know for Linux, Apple, Android, and other products. =20

An upgrade of the extension packaging could provide some auditability.  =
Perhaps the most important upgrade, using a form of ODF 1.2 packaging, =
would be use of digital signatures to provide a level of authentication =
on the extension/template source and allow detection of modifications or =
counterfeits.

Other kinds of auditing and forensic analysis require better =
computer-based tools.  Those are lacking generally, not just for =
extension packages.

This is one of those situations where defenses require considerable more =
effort than attacking, although skill is required for an exploit to go =
undetected.

No concerted effort on this area is foreseen at this time. =20

 - Dennis =20


> -----Original Message-----
> From: toki [mailto:toki.kantoor@gmail.com]
> Sent: Thursday, April 7, 2016 03:45
> To: dev@openoffice.apache.org
> Subject: Cross Script vulnerabilities in AOo Extensions?
>=20
> All:
>=20
> In reading
> http://arstechnica.com/security/2016/04/noscript-and-other-popular-
> firefox-add-ons-open-millions-to-new-attack/
> is the same type of vulnerability is possible with AOo extensions?
>=20
> jonathon
>=20


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org