PT-2008-1772 · Microsoft · Office Excel+1

Dan Hubbard + 1 · Publicado 2008-03-11 · Atualizado 2018-10-12 · CVE-2008-0117

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Excel versions 2000 SP3 and 2002 SP2 Microsoft Office versions 2004 and 2008 for Mac

Description The issue allows remote attackers to execute arbitrary code via crafted conditional formatting values. A remote code execution vulnerability exists in the way Excel handles conditional formatting values. An attacker could exploit the vulnerability by sending a malformed file which could be hosted on a specially crafted or compromised Web site, or included as an e-mail attachment.

Recommendations For Microsoft Excel 2000 SP3, update to a version that is not affected by this issue. For Microsoft Excel 2002 SP2, update to a version that is not affected by this issue. For Microsoft Office 2004 for Mac, update to a version that is not affected by this issue. For Microsoft Office 2008 for Mac, update to a version that is not affected by this issue. As a temporary workaround, consider avoiding the use of conditional formatting values in Excel until a patch is available.

Exploit

Correção

Identificadores relacionados

CVE-2008-0117

Produtos afetados

Office Excel

Office

Referências · 12

• 🔥 https://exploit-db.com/exploits/5287 · Exploit
• http://marc.info/?l=bugtraq&m=120585858807305&w=2 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0117 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2008-0117 · Nota de Segurança
• http://vupen.com/english/advisories/2008/0846/references · Nota
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS08-014 · Nota
• http://us-cert.gov/cas/techalerts/TA08-071A.html · Correção
• http://securityfocus.com/bid/28170 · Correção
• http://securitytracker.com/id?1019587 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5508 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0117 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-014 · Aviso do Fabricante