Again if you use either suite be sure you upgrade to the latest version as soon as possible. Kudos to the developers for quickly addressing these security issues. This is because an invalid signature algorithm could still make a laced document appear as it comes from a trusted source.
Also note that if you are running an older version you shouldn't rely on the "trusted list" functionality. If you are unable to upgrade whatever the reason a viable temporary solution would be to disable macros. Given the risks that these security flaws represent you should upgrade to the latest version as soon as possible. That means that unless you're very good about checking for new versions on a regular basis the version you're currently using is probably out of date. It should be noted that neither of these applications are auto-updating. That means that this flaw has roots that run deep. An offshoot that was created decades ago.
For those who don't know LibreOffice is a fork of OpenOffice. The OpenOffice flaw is being tracked as CVE-2021-41832 and the LibreOffice flaw is being tracked as CVE-2021-25635. As such the ability to spoof those signatures could easily open the floodgates allowing attackers to do untold harm to any business using either Libre- or OpenOffice. Digital signatures are used as a means of verifying that the document in question is from a trusted source. This vulnerability allows an attacker to modify and manipulate documents so that it appears they have been signed by a trusted party.Īlthough the flaw that makes this possible has only been classified "Moderate" the reality is that the implications could be crippling. LibreOffice and OpenOffice released security updates to address a moderate-severity flaw that can allow attackers to manipulate documents to appear as signed by a trusted source. Do you use LibreOffice or OpenOffice? If so be aware that security updates have recently been issued due to the recent discovery of a major security flaw. LibreOffice and OpenOffice released security updates to address a vulnerability that can be exploited by an attacker to spoof signed documents.
0 kommentar(er)
