Re: Remote file inclusion by office applications

[Tim Brown <tmb () 65535 com>]

On Friday 14 Dec 2012 00:24:33 Kurt Seifried wrote:
> On 12/13/2012 11:53 AM, Daniel Kahn Gillmor wrote:
> > On 12/13/2012 11:44 AM, Kurt Seifried wrote:
> > > I'm kind of leaning towards classifying this as a security issue
> > > since I expected there is some way to disable it or at least tell
> > > it to prompt me when a document tries to go get an external data
> > > source (e.g. "this document contains external data, the URLs/file
> > > paths it is trying to  reference are: [list of locations]") but
> > > apparently there is no way to disable/have this prompt (at least
> > > that I can find in LibreOffice)?
> >
> > I think your assessment is correct.  I've just now made an ODT file
> > that libreoffice uses to not only hit the network for a PNG (denial
> > of service attacks, remote exploitation of other flaws in libpng or
> > in LO itself, virus scanner bypass, etc), but one that will include
> > and render ~/.ssh/id_rsa as a text/plain document.  This seems like
> > it could be done against any local privileged file.
> >
> > For local file inclusion, libreoffice at leasts prompts me with:
> >
> > ----------- This document contains one or more links to external
> > data.
> >
> > Would you like to change the document, and update all links to get
> > the most recent data?
> >
> > [Yes] [No] -----------
> >
> > but it doesn't tell me what those documents are. And given the UI
> > history of people clicking through popups they don't understand,
> > i'm not convinced that this popup is going to do anything to
> > prevent remote disclosure (it even defaults to "Yes").  When i say
> > "no" on the prompt, it goes out and fetches networked URLs anyway,
> > so i assume this prompt is supposed to just refer to local
> > "external data".
> >
> > --dkg

Confirmed.  By comparison both Okular and Calligra Office ignore the remote and 
local file references (without even prompting).

Tim
-- 
Tim Brown
<mailto:tmb () 65535 com>

Attachment: signature.asc
Description: This is a digitally signed message part.