search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Groove Virtual Office may not correctly display file names

Vulnerability Note VU#232232

Original Release Date: 2005-05-19 | Last Revised: 2005-05-26


Groove Virtual Office may not correctly display the names of attached or embedded files. A remote attacker may be able to trick a user into executing arbitrary code.


Groove Virtual Office provides a collaborative working environment that includes shared documents, databases, applications, and various other tools to facilitate communication and productivity. Groove allows files to be attached to, or embedded in a document via Microsoft Windows Object Linking and Embedding (OLE). Microsoft OLE is a technology that allows applications to create and edit compound documents. Compound documents are those consisting of one format that contain embeddings of (or links to) documents in another format.

If a specially crafted file is attached to, or embedded in a compound document, its file extension may not be shown correctly. As a result, the user may be tricked into believing the embedded file is of a type that does not contain executable code/content. However, if the crafted file contains code, it may be executed when the file is opened.


If a remote attacker can persuade a user to open a specially crafted file, that attacker may be able to execute arbitrary code with the privileges of the user.


This vulnerability is addressed in Groove Virtual Office 3.1 build 2338, 3.1a build 2364, and Groove Workspace Version 2.5n build 1871. These updates are available from


Vendor Information


Groove Networks Affected

Updated:  May 19, 2005



Vendor Statement

Analysis has identified security vulnerability in older versions of the Groove Virtual Office client software that warranted immediate attention to correct. Although we are not aware of any incidents leveraging the vulnerability, we have responded to address issues that have been identified.

A security update to Groove Virtual Office v3.1 was posted several weeks ago as build 2338. More recently, a maintenance release to Groove Virtual Office, v3.1a build 2364, was posted on the website on April 27th, 2005. This latest release contains all of the security updates plus some addition al maintenance items. If you are running a release prior to 2338 of Groove Virtual Office, we encourage you to update immediately to the latest releases of Groove Virtual Office at:

An update to the previous major release, Groove Workspace Version 2.5n build 1871, is also available. We recommend that all users of Groove Workspace Version 2 update to this version of the
software at:

If you use a customized enterprise installation kit for deployment of the Groove software in your organization, the kits for these versions can be obtained from your Groove sales representative or client manager.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.


US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CVSS Metrics

Group Score Vector



This vulnerability was reported by US-CERT.

This document was written by Jeff Gennari.

Other Information

CVE IDs: None
Severity Metric: 2.36
Date Public: 2005-05-19
Date First Published: 2005-05-19
Date Last Updated: 2005-05-26 01:13 UTC
Document Revision: 87

Sponsored by CISA.