PT-2008-1771 · Microsoft · Office Excel+3

Publicado 2008-03-11 · Atualizado 2018-10-15 · CVE-2008-0116

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Excel versions 2000 SP3 through 2003 SP2 Microsoft Excel Viewer 2003 Microsoft Office Compatibility Pack Microsoft Office 2004 for Mac Microsoft Office 2008 for Mac

Description A remote code execution issue exists due to the handling of rich text values when loading application data into memory. An attacker could exploit this by sending a malformed file, which could be hosted on a specially crafted or compromised web site, or included as an email attachment.

Recommendations For Microsoft Excel versions 2000 SP3 through 2003 SP2, consider avoiding the use of rich text values until a patch is available. For Microsoft Excel Viewer 2003, restrict access to malformed files to minimize the risk of exploitation. For Microsoft Office Compatibility Pack, avoid using the pack to open potentially malicious files until the issue is resolved. For Microsoft Office 2004 and 2008 for Mac, refrain from opening attachments or files from untrusted sources that could contain malformed rich text values.

Exploit

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

CWE-20

Identificadores relacionados

CVE-2008-0116

Produtos afetados

Office Excel

Excel Viewer

Office

Office Compatibility Pack

Referências · 14

• 🔥 https://exploit-db.com/exploits/5287 · Exploit
• http://marc.info/?l=bugtraq&m=120585858807305&w=2 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0116 · Nota de Segurança
• http://vupen.com/english/advisories/2008/0846/references · Aviso do Fabricante
• http://securityfocus.com/archive/1/489430/100/0/threaded · Nota
• http://securitytracker.com/id?1019586 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5212 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-0116 · Nota de Segurança
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS08-014 · Nota
• http://securityfocus.com/bid/28168 · Correção
• http://us-cert.gov/cas/techalerts/TA08-071A.html · Correção
• http://dvlabs.tippingpoint.com/advisory/TPTI-08-03 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-014 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0116 · Nota