PT-2008-1767 · Microsoft · Office Excel+1

Yoshiya Sasaki · Publicado 2008-03-11 · Atualizado 2018-10-12 · CVE-2008-0112

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Excel versions 2000 SP3 Office for Mac versions 2004 and 2008

Description The issue allows remote attackers to execute arbitrary code via a crafted .SLK file that is not properly handled when importing the file. This can occur when an attacker sends a malformed .slk file, which could be hosted on a specially crafted or compromised Web site, or included as an e-mail attachment, and then imports it into Excel.

Recommendations For Microsoft Excel 2000 SP3, consider avoiding the import of .SLK files from untrusted sources until a fix is available. For Office for Mac 2004 and 2008, restrict the import of .SLK files to trusted sources to minimize the risk of exploitation.

Exploit

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2008-0112

Produtos afetados

Office Excel

Office For Mac

Referências · 12

• 🔥 https://exploit-db.com/exploits/5287 · Exploit
• http://marc.info/?l=bugtraq&m=120585858807305&w=2 · Aviso do Fabricante
• http://securityfocus.com/bid/28095 · Correção
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5284 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0112 · Nota
• http://securitytracker.com/id?1019583 · Nota
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS08-014 · Nota
• http://vupen.com/english/advisories/2008/0846/references · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-0112 · Nota de Segurança
• http://us-cert.gov/cas/techalerts/TA08-071A.html · Correção
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0112 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-014 · Aviso do Fabricante