PT-2008-1769 · Microsoft · Office For Mac+2

Publicado 2008-03-11 · Atualizado 2018-10-12 · CVE-2008-0114

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Excel versions 2000 SP3 through 2003 SP2 Microsoft Excel Viewer 2003 Microsoft Office for Mac 2004

Description The issue allows user-assisted remote attackers to execute arbitrary code via crafted Style records that trigger memory corruption. A remote code execution vulnerability exists in the way Excel handles Style record data when opening Excel files. An attacker could exploit the issue by sending a malformed file which could be hosted on a specially crafted or compromised Web site, or included as an e-mail attachment.

Recommendations For Microsoft Excel versions 2000 SP3 through 2003 SP2, consider avoiding the use of Style records in Excel files until a fix is available. For Microsoft Excel Viewer 2003, restrict the opening of Excel files from untrusted sources to minimize the risk of exploitation. For Microsoft Office for Mac 2004, avoid using the affected version to open Excel files from unknown or untrusted sources until the issue is resolved.

Exploit

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2008-0114

Produtos afetados

Office Excel

Excel Viewer

Office For Mac

Referências · 12

• 🔥 https://exploit-db.com/exploits/5287 · Exploit
• http://marc.info/?l=bugtraq&m=120585858807305&w=2 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0114 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2008-0114 · Nota de Segurança
• http://securitytracker.com/id?1019584 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0114 · Nota
• http://securityfocus.com/bid/28166 · Correção
• http://vupen.com/english/advisories/2008/0846/references · Nota
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS08-014 · Nota
• http://us-cert.gov/cas/techalerts/TA08-071A.html · Correção
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-014 · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5456 · Nota