PT-2008-1766 · Microsoft · Office Excel+3

Greg Macmanus · Publicado 2008-03-11 · Atualizado 2018-10-12 · CVE-2008-0111

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Excel versions 2000 SP3 through 2007 Microsoft Excel Viewer 2003 Microsoft Office Compatibility Pack Microsoft Office 2004 for Mac

Description The issue allows user-assisted remote attackers to execute arbitrary code via crafted data validation records. A remote code execution vulnerability exists in the way Excel processes data validation records when loading Excel files into memory. An attacker could exploit the vulnerability by sending a malformed file which could be hosted on a specially crafted or compromised Web site, or included as an e-mail attachment.

Recommendations For Microsoft Excel versions 2000 SP3 through 2007, consider avoiding the use of data validation records until a patch is available. For Microsoft Excel Viewer 2003, restrict access to loading Excel files from untrusted sources to minimize the risk of exploitation. For Microsoft Office Compatibility Pack, avoid using the pack to open Excel files from unknown sources until the issue is resolved. For Microsoft Office 2004 for Mac, as a temporary workaround, consider disabling the loading of Excel files with data validation records until a patch is available.

Exploit

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2008-0111

Produtos afetados

Office Excel

Excel Viewer

Office

Office Compatibility Pack

Referências · 12

• 🔥 https://exploit-db.com/exploits/5287 · Exploit
• http://marc.info/?l=bugtraq&m=120585858807305&w=2 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0111 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5114 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-0111 · Nota de Segurança
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS08-014 · Nota
• http://vupen.com/english/advisories/2008/0846/references · Nota
• http://securityfocus.com/bid/28094 · Correção
• http://us-cert.gov/cas/techalerts/TA08-071A.html · Correção
• http://securitytracker.com/id?1019582 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-014 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0111 · Nota de Segurança