Issue 51500 - OpenOffice can compromise people's privacy by putting UUIDs that reveal their ethernet addresses into documents
Summary: OpenOffice can compromise people's privacy by putting UUIDs that reveal their...
Status: CLOSED NOT_AN_OOO_ISSUE
Alias: None
Product: *Testproduct
Classification: Test
Component: votetest (show other issues)
Version: current
Hardware: All All
: P3 Trivial (vote)
Target Milestone: not determined
Assignee: issues@test
QA Contact: issues@test
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2005-07-03 06:12 UTC by nealmcb
Modified: 2011-03-05 17:30 UTC (History)
1 user (show)

See Also:
Issue Type: DEFECT
Latest Confirmation in: ---
Developer Difficulty: ---


Attachments

Note You need to log in before you can comment on or make changes to this issue.
Description nealmcb 2005-07-03 06:12:56 UTC
Openoffice generates and discloses UUIDs in a way that 
can reveal the ethernet address used to generate the document.

UUIDs (Universally Unique IDentifiers) are commonly used
to provide unique names for things.  See more at
http://en.wikipedia.org/wiki/Universally_Unique_Identifier.

Microsoft got a bad reputation years ago for publishing
ethernet addresses in Word documents via UUIDs,
as documented at
http://en.wikipedia.org/wiki/Globally_Unique_Identifier

Now OpenOffice is doing the same thing.  One example is the "Id"
attribute of the Signature element in the
META-INF/documentsignatures.xml file that contains document signatures
inside Writer ".odt" documents generated by recent OpenOffice 2.0
snapshots.  I've verified that on my Ubuntu 5.04 Linux machine running
1.9.87, my ethernet address showed up in a document I signed, and
since the code looks like it would do the same thing again, I haven't
waited to confirm it on a more recent build.  (I assume I don't have
to explain that even signed documents shouldn't generally reveal
their host addresses).

Since there are hundreds of places in the code where the
rtl_createUuid function is told to include an ethernet address, I
assume they show up in other places also.  I don't know if this
is a problem for OpenOffice version 1.

I suspect the best way to fix this is by just using random UUIDs
(version 4) like Microsoft seems to do now in their GUIDs.

Search for lines of code that put ethernet addresses in
freshly generated UUIDs:

 http://go-ooo.org/lxr/search?filestring=&advanced=1&string=rtl_createUuid.*+sal_True
Comment 1 mci 2005-07-28 06:43:24 UTC
duplicate to issue 51501 ?
Comment 2 frank 2005-07-28 08:25:20 UTC
invalid as double to the same Issue from the same submitter
Comment 3 frank 2005-07-28 08:25:38 UTC
closed inv