Package for OOo Security Bulletin 2006-06-29

OpenOffice.org 2.0.3 has been announced as out !
(french version is expected in the coming hours)

This announcement provides a security
bulletin dealing with 3 potential vulnerabilities detected by internal
security audits.

if you can not install this new 2.0.3 version for whatever reason, the
issue dealing with java applet can be countered as mentionned on the Java Applets,
CVE-2006-2199 dedicated page
(be carefull that other issues remain !!)

The solution proposed works great by deactivating java applets but is not
so easy to deploy at large scale or for regular users. So i used the OOo
Tools for what they are made for : The UNO Package concept that allow to
create great
extensions but also
deploy configuration settings

So this addon reproduces what is proposed on the CVE page. It works for OOo
2.x as well as OOo 1.x

To deploy under OOo 2.x

• Tools > Package Manager > add and select the zip file
  or

• launch <OOoInstall>/program/unopkg <ZipFilePath>

To deploy under OOo 1.x

• launch <OOoInstall>/program/pkgchk <ZipFilePath>

Note that running these command lines with the -s switch (for share) let
you deploy the addon for all your users

For testing that the patch has been applied correctly, you can insert an
applet (eg. the
JavaClock.class can be used for testing purpose) and see if it does not run.

You insert a java Applet though

• Insert > Object > Applet

Once the patch applied, only a drawing with the name of the applet should be
displayed and the applet should not run anymore

This check also apply to already created document containing applets

(Post originally written by Laurent Godard on the old Nuxeo blogs.)