iDefense Security Advisory 04.17.08 – Remote exploitation of an integer underflow vulnerability in OpenOffice, as included in various vendors’ operating system distributions, allows attackers to execute arbitrary code with the privileges of the logged in user. The vulnerability exists within the code responsible for converting the QPRO file into an internal representation used by OpenOffice. A 16-bit integer is read in from the file, and later used as a loop counter that controls how many values are stored into local stack buffers. When verifying the value of this counter, the code decrements the counter without checking to see if this operation will underflow. This results in the loop running for many iterations, which leads to a stack based buffer overflow. This allows for the execution of arbitrary code. iDefense has confirmed the existence of this vulnerability in OpenOffice version 2.3. Other versions may also be affected.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/65622/04.17.08-4.txt
Source: https://packetstormsecurity.com/files/65622/iDEFENSE-Security-Advisory-2008-04-17.4.html