#Openoffice bug allows hackers to spoof upgrade#

If you’re using either of the open-source office suites, you’re advised to upgrade to the latest available version immediately.

The same flaw impacts LibreOffice, which is a fork of OpenOffice spawned from the main project over a decade ago, and for their project is tracked as CVE-2021-25635. The discovery of the flaw, which is tracked as CVE-2021-41832 for OpenOffice, was the work of four researchers at the Ruhr University Bochum. 'Allowing anyone to sign macro-ridden documents themselves, and make them appear as trustworthy, is an excellent way to trick users into running malicious code. The digital signatures used in document macros are meant to help the user verify that the document hasn’t been altered and can be trusted.

#Openoffice bug allows hackers to spoof update#

Currently, phone manufacturers and carriers are working on a firmware update that will be sent out to users.LibreOffice and OpenOffice have pushed updates to address a vulnerability that makes it possible for an attacker to manipulate documents to appear as signed by a trusted source.Īlthough the severity of the flaw is classified as moderate, the implications could be dire. Google has already sent out a generic code fix for Fake ID. This could lead to malicious apps accessing data and executing actions on other apps. However, all devices that are running on anything older than Android 4.4 Kitkat are still vulnerable to malicious apps that insert Trojan horse code into other apps.

#Openoffice bug allows hackers to spoof Patch#

Google was alerted to the bug and released a patch last April. Forristal said that Fake ID dates back to the launch of Android 2.1 in January 2010 and can be used on all Android devices that do not have the patch for Google bug 13678484.

The vulnerability affects all Android phones. After that, attackers can sign an application with the malicious identity certificate and the forged certificate authority claim. According to Bluebox, the security hole allows hackers to create their own identity certificates then forge a claim it was issued through a certificate authority. This means that a web browser would trust any certificate issued by Verisign. Identity certificates are issued through certificate authorities such as Verisign. For example, the vulnerability can be used by malware to escape the normal application sandbox and take one or more malicious actions: insert a Trojan horse into an application by impersonating Adobe systems gain access to NFC financial and payment data by impersonating Google Wallet or take full management control of the entire device by impersonating 3LM,' Jeff Forristal, Bluebox's Chief Technology Officer, said in a blog post.įake ID works by exploiting Android's method of handling identity certificates, which verifies that an app is what it appears to be. This can result in a wide spectrum of consequences. 'The vulnerability allows malicious applications to impersonate specially recognized trusted applications without any user notification.