PT-2008-1765 · Microsoft · Office Xp+3

Greg Macmanus · Publicado 2008-03-11 · Atualizado 2018-10-12 · CVE-2008-0110

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Outlook in Office versions prior to the fixed version

Description The issue allows remote code execution if a specially crafted mailto URI is passed to Outlook. This could enable an attacker to install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights on the system may be less impacted than those operating with administrative user rights.

Recommendations For Microsoft Outlook in Office 2000 SP3, update to a version that includes the fix for this issue. For Microsoft Outlook in Office XP SP3, update to a version that includes the fix for this issue. For Microsoft Outlook in Office 2003 SP2 and SP3, update to a version that includes the fix for this issue. As a temporary workaround, consider avoiding the use of crafted mailto URIs in Outlook until a patch is available.

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2008-0110

Produtos afetados

Outlook

Office 2000

Office 2003

Office Xp

Referências · 12

• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5278 · Nota
• http://marc.info/?l=bugtraq&m=120585858807305&w=2 · Aviso do Fabricante
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS08-015 · Nota
• http://secunia.com/advisories/29320 · Aviso do Fabricante
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-015 · Aviso do Fabricante
• http://kb.cert.org/vuls/id/393305 · Nota
• http://us-cert.gov/cas/techalerts/TA08-071A.html · Nota
• http://vupen.com/english/advisories/2008/0847/references · Nota
• http://securityfocus.com/bid/28147 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2008-0110 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0110 · Nota de Segurança
• http://securitytracker.com/id?1019579 · Nota