PT-2008-1773 · Microsoft · Office Xp+5
Publicado
2008-03-11
·
Atualizado
2018-10-12
·
CVE-2008-0118
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Microsoft Office 2000 SP3
Microsoft Office XP SP3
Microsoft Office 2003 SP2
Microsoft Excel Viewer 2003 up to SP3
Microsoft Office 2004 for Mac
Description
The issue allows remote attackers to execute arbitrary code via a crafted Office document, triggering memory corruption from an allocation error. A remote code execution vulnerability exists in the way Microsoft Office processes malformed Office files. An attacker could exploit this by creating a malformed Office file, which could be included as an e-mail attachment or hosted on a specially crafted or compromised Web site. If a user were logged on with administrative user rights, an attacker who successfully exploited this could take complete control of an affected system, allowing them to install programs, view, change, or delete data, or create new accounts with full user rights.
Recommendations
For Microsoft Office 2000 SP3, update to a newer version to mitigate the risk.
For Microsoft Office XP SP3, update to a newer version to mitigate the risk.
For Microsoft Office 2003 SP2, update to a newer version to mitigate the risk.
For Microsoft Excel Viewer 2003 up to SP3, update to a newer version to mitigate the risk.
For Microsoft Office 2004 for Mac, update to a newer version to mitigate the risk.
As a temporary workaround, consider avoiding the use of crafted Office documents until a patch is available.
Restrict access to administrative user rights to minimize the risk of exploitation.
Exploit
Correção
RCE
Code Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Excel Viewer 2003
Office 2000
Office 2003
Office 2004 For Mac
Office Xp
Office