PT-2008-1776 · Microsoft · Powerpoint Viewer 2003+1

Publicado 2008-08-12 · Atualizado 2018-10-12 · CVE-2008-0121

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft PowerPoint Viewer 2003

Description A memory calculation error in Microsoft PowerPoint Viewer 2003 allows remote attackers to execute arbitrary code via a PowerPoint file with an invalid picture index that triggers memory corruption. This issue is related to the way Microsoft Office PowerPoint Viewer 2003 handles specially crafted PowerPoint files. An attacker could exploit this by creating a specially crafted PowerPoint file that could be included as an e-mail attachment or hosted on a specially crafted or compromised Web site. If successfully exploited, an attacker could take complete control of an affected system, allowing them to install programs, view, change, or delete data, or create new accounts with full user rights. The impact is more significant for users with administrative user rights.

Recommendations For Microsoft PowerPoint Viewer 2003, update to a version that includes the fix for the memory calculation error to prevent exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2008-0121

Produtos afetados

Powerpoint Viewer 2003

Office Powerpoint

Referências · 12

• http://us-cert.gov/cas/techalerts/TA08-225A.html · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-051 · Aviso do Fabricante
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=738 · Nota
• http://vupen.com/english/advisories/2008/2355 · Nota
• http://securityfocus.com/bid/30554 · Nota
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS08-051 · Nota
• http://secunia.com/advisories/31453 · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5724 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-0121 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0121 · Nota de Segurança
• http://securitytracker.com/id?1020676 · Nota
• http://marc.info/?l=bugtraq&m=121915960406986&w=2 · Aviso do Fabricante