CVE-2016-6804 in OpenOffice
Summary
by MITRE
The Apache OpenOffice installer (versions prior to 4.1.3, including some branded as OpenOffice.org) for Windows contains a defective operation that allows execution of arbitrary code with elevated privileges. This requires that the location in which the installer is run has been previously poisoned by a file that impersonates a dynamic-link library that the installer depends upon.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2022
The vulnerability identified as CVE-2016-6804 represents a critical privilege escalation flaw within the Apache OpenOffice installer for Windows platforms. This security weakness affects versions prior to 4.1.3 and encompasses both the standard Apache OpenOffice releases and those branded as OpenOffice.org. The vulnerability stems from a design flaw in the installer's dynamic link library resolution mechanism, which creates an exploitable condition that can be leveraged by attackers to execute malicious code with elevated privileges. The flaw specifically manifests when the installer operates in an environment where malicious files have been strategically placed to masquerade as legitimate system components.
The technical implementation of this vulnerability exploits the installer's dependency resolution process, where it attempts to load dynamic-link libraries from the current working directory before checking system directories. This behavior creates a race condition and path traversal opportunity that attackers can manipulate by placing malicious DLL files in the same directory as the installer. The installer's trust model is fundamentally compromised when it loads these impostor libraries, allowing attackers to inject arbitrary code that executes with the privileges of the installer process. This type of vulnerability is classified under CWE-426 as an Untrusted Search Path, where the application searches for libraries in insecure locations and loads them without proper validation. The flaw essentially allows for a form of DLL hijacking that bypasses standard security mechanisms.
The operational impact of CVE-2016-6804 extends beyond simple code execution, as it enables full system compromise through privilege escalation. An attacker who successfully exploits this vulnerability can gain elevated privileges that would typically require administrative access, effectively allowing them to install malware, modify system files, or establish persistent backdoors. The vulnerability is particularly concerning because it can be exploited through social engineering techniques, where users might unknowingly download and execute the installer in a compromised directory. This attack vector is especially dangerous in enterprise environments where users might run installers from shared network drives or temporary directories that have been previously compromised. The attack chain aligns with ATT&CK technique T1059.001 for command and script interpreter, and T1068 for exploit for privilege escalation, making it a significant threat to organizational security.
Mitigation strategies for CVE-2016-6804 primarily focus on upgrading to Apache OpenOffice version 4.1.3 or later, which contains the necessary patches to address the installer's dependency resolution behavior. Organizations should implement strict access controls and directory permissions to prevent unauthorized file placement in directories where installers might be executed. The use of application whitelisting solutions can help prevent execution of unauthorized binaries, while security awareness training can reduce the risk of users inadvertently executing compromised installers. System administrators should also monitor for suspicious file creation patterns in installer directories and implement proper file integrity checking mechanisms. The vulnerability's exploitation requires specific conditions to be met, including the presence of poisoned directories and user execution of the installer, making defensive measures such as network segmentation and privilege minimization effective countermeasures. Regular security assessments and vulnerability scanning should include checks for the presence of vulnerable OpenOffice versions to ensure comprehensive protection against this and similar privilege escalation threats.