Secunia CSI7
Advisories
Research
Forums
Create Profile
Our Commitment
PSI
PSI API
CSI
OSI
xSI
Vulnerabilities
Programs
Open Discussions
My Threads
Create Thread
Statistics
About

Forum Thread: OpenOffice 3.0

You are currently viewing a forum thread in the Secunia Community Forum. Please note that opinions expressed here are not of Secunia but solely reflect those of the user who wrote it.

This thread was submitted in the following forum:
Programs

Relating to this vendor:
OpenOffice.org
And, this specific program:
OpenOffice.org 3.x

This thread has been marked as locked.
TomtheJazzman OpenOffice 3.0
Member 4th Jun, 2010 23:53
Ranking: 0
Posts: 1
User Since: 6th Jan, 2010
System Score: N/A
Location: N/A
I am getting threat shown for OpenOffice Software. I have clicked to resolved and rescanned but the threat still is there. Any suggestion to get it to leave.

mogs RE: OpenOffice 3.0
Expert Contributor 5th Jun, 2010 00:18
Score: 2265
Posts: 6,266
User Since: 22nd Apr 2009
System Score: 100%
Location: UK
Hello.
Are you using psi with the Advanced interface ? If not, switch to it to gain access to more info. Click on the + sign alongside the insecurity...the entry will expand to reveal the file path...click Tech. Details and it will confirm it. If unsure what to do next, post that info and any other details back to the forum.
Remember, that when you update....often older files/versions are left behind....psi continues to detect them, even if they are in the Recycle bin. Regards

--
Was this reply relevant?
+0
-0
TiMow RE: OpenOffice 3.0
Dedicated Contributor 5th Jun, 2010 11:03
Score: 737
Posts: 728
User Since: 26th Jun 2009
System Score: N/A
Location: CH
Last edited on 5th Jun, 2010 11:15
After clicking "Download Solution", from PSI, and installing update you should re-start/re-boot your PC and then scan.

Also in Open Office, Help menu > check for updates.

In my O.O., Help > About OpenOffice.org, it lists the following as latest (and secure with PSI):

OpenOffice.org 3.2.0
OOO320m 12 (Build 9483)

The same version is listed under PSI Patched tab (Advanced) as:

3.2.9476.500

Any other (earlier) version, especially 3.0, will be flagged as insecure by PSI.

PSI is obviously finding this version still installed on your PC.
You need to follow the directions from @mogs, above to find it's location, and if unsure of what action to take, then post the file path back here.

For some reason, when O.O. is updated it moves the contents form the previous folder to the new update folder, still leaving the old folder, but this then shows as empty, and poses no threat. Maybe your 3.0 folder still contains, some files that PSI is reporting.

In Start menu choose Search > then All Files and Folders > in top box type Open Office > then "Look In", choose Local Hard Drives (C:) and click search.

This will list all Open Office folders you have installed. I have two for O.O 3.0 - one is shortcut (ignore); the other is listed as File Folder. Hover the curser over this "Open Office.org 3.0", it will give the full file path and should then report "Folder is Empty". If it gives a numerical file size (in KB), then that is where the problem lies - you should then check the contents, and if unsure, post back here.

TiMow

EDIT: One further thought - if your use an external drive, or have a backup/restore D:\ drive, then PSI could be finding a copy here, as it reports on all drives. That is why knowing the file path of the insecurity is important, and also which Windows OS you have.


--
Computing is not yet a perfect science - it still requires humans.
Was this reply relevant?
+0
-0
ddmarshall RE: OpenOffice 3.0
Dedicated Contributor 5th Jun, 2010 11:26
Score: 1209
Posts: 961
User Since: 8th Nov 2008
System Score: 98%
Location: UK
Open Office was updated to 3.2.1 on 4th June.

http://www.openoffice.org/security/bulletin.html

--
This answer is provided “as-is.” You bear the risk of using it.
Was this reply relevant?
+0
-0
TiMow RE: OpenOffice 3.0
Dedicated Contributor 5th Jun, 2010 11:38
Score: 737
Posts: 728
User Since: 26th Jun 2009
System Score: N/A
Location: CH
Last edited on 5th Jun, 2010 11:53
Thanks ddm

So much for the in-built check for updates - it's still reporting 3.2.0 as up to date.
I'll run a scan to see what that throws up.

Regards

TiMow

EDIT: As of the time of this edit being posted (see l.h.s.), PSI is not flagging 3.2.0 as insecure, despite the info. in the above link. It appears that the OOo update checker, and PSI rules need to catch up.

--
Computing is not yet a perfect science - it still requires humans.
Was this reply relevant?
+0
-0
Anthony Wells RE: OpenOffice 3.0
Expert Contributor 5th Jun, 2010 13:05
Score: 2437
Posts: 3,332
User Since: 19th Dec 2007
System Score: N/A
Location: N/A
Last edited on 5th Jun, 2010 13:15
To All ,

I was advised by email that Version 3.2.1. is a security update ; the security fixes are not yet "publicised" , allowing users to "catch up" .

The latest version is 3.2.1. 000320m18(build9502) displayed by PSI as version 3.2.9498.500 as "patched"- this is the English - us version that I have for the moment .

Not all language versions are updated -including English- GB (scroll down) :-

http://download.openoffice.org/other.html

Both PSI and available versions will update in the next few days to match the public announcement and the relevant SA ; by past experience some language versions may take some time to update .

Hope this helps.

Anthony

For TomtheJazzman ,

What is the installation path for your "insecure" version , what is te version number ??

--


It always seems impossible until its done.
Nelson Mandela
Was this reply relevant?
+0
-0
TiMow RE: OpenOffice 3.0
Dedicated Contributor 5th Jun, 2010 13:51
Score: 737
Posts: 728
User Since: 26th Jun 2009
System Score: N/A
Location: CH
Last edited on 5th Jun, 2010 14:01
Hi Anthony

Thanks for clarification - useful to all.

Re. this thread - on/in the red bar at the head of the thread is written Open office 3.0 - so even without the full no., it is well out of date and insecure.

When I did a search, I was surprised to find empty folders from previous version numbers (3.0, 3.1), with only the latest (3.2) having component files. I was not aware until this point - probably need to do a little housekeeping - but empty folders pose no threat.

They were listed under documents and settings, and not program files (as is the main program).

Obviously the file path of this specific case should reveal much.

TiMow

--
Computing is not yet a perfect science - it still requires humans.
Was this reply relevant?
+0
-0
Anthony Wells RE: OpenOffice 3.0
Expert Contributor 5th Jun, 2010 17:55
Score: 2437
Posts: 3,332
User Since: 19th Dec 2007
System Score: N/A
Location: N/A


TiMow ,

I allow the OOo installer to run a "full" update each time and so it over-installs in my Program Files folder and it has the notation "OpenOffice.org 3" as it's folder name .

The installer will unpack a whole set of files called "installation files" - default is often to Desktop and these are called OpenOffice.org 3.2(en-us) installation files in my case - I have seen other annotations); they weigh in at 151 Mo so will slow your computer's "start up" if you leave them on your desktop - "cut and paste" to a more discrete location . I always keep of copy of those files and the latest installer - with fast broadband , possibly no longer necessary .

I have OOo 2 and 3 folders in Documents and Settings weighing in at 2.05 and 2.70 Mo respectively ; I'm lazy so my housekeeping keeps in mind "if it ain't broke , don't fix it ." Secunia/PSI is "happy" with them :)

The thread title was the OP's choice , feel free to quote me if you need to answer a 3.1 or 3.2 thread .

Take care
Anthony

--


It always seems impossible until its done.
Nelson Mandela
Was this reply relevant?
+0
-0

This thread has been marked as locked.


 Products Solutions Customers Partner Resources Company
 
 Corporate
Vulnerability Intelligence Manager (VIM)
Corporate Software Inspector (CSI)
Consumer
Personal Software Inspector (PSI)
Online Software Inspector (OSI)
 Industry
Compliance
Technology
Integration
 Customers
Testimonials
 VARS
MSSP
Technology Partners
References
 Reports
Webinars
Events
 About us
Careers
Memberships
Newsroom


 
© 2002-2014 Secunia ApS - Rued Langgaards Vej 8, 4th floor, DK-2300 Copenhagen, Denmark - +45 7020 5144
Terms & Conditions and Copyright - Privacy - Report Vulnerability