PT-2008-4436 · Microsoft · Office+2

Publicado 2008-08-12 · Atualizado 2018-10-30 · CVE-2008-3004

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office Excel versions 2000 SP3, 2002 SP3, 2003 SP2, 2003 SP3 Office Excel Viewer version 2003 Office versions 2004, 2008 for Mac

Description A remote code execution issue exists due to improper validation of index values for AxesSet records when loading Excel files. This allows attackers to execute arbitrary code via a crafted Excel file. An attacker could exploit this by opening a specially crafted file, which could be hosted on a website or included as an email attachment.

Recommendations For Microsoft Office Excel 2000 SP3, update to a version that properly validates index values for AxesSet records. For Microsoft Office Excel 2002 SP3, update to a version that properly validates index values for AxesSet records. For Microsoft Office Excel 2003 SP2 and SP3, update to a version that properly validates index values for AxesSet records. For Office Excel Viewer 2003, update to a version that properly validates index values for AxesSet records. For Office 2004 and 2008 for Mac, update to a version that properly validates index values for AxesSet records.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2008-3004

Produtos afetados

Office Excel

Office

Office Excel Viewer

Referências · 12

• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5885 · Nota
• http://securitytracker.com/id?1020670 · Nota
• http://us-cert.gov/cas/techalerts/TA08-225A.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-3004 · Nota de Segurança
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=740 · Nota
• http://secunia.com/advisories/31454 · Aviso do Fabricante
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS08-043 · Nota
• http://securityfocus.com/bid/30638 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-043 · Aviso do Fabricante
• http://vupen.com/english/advisories/2008/2347 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3004 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=121915960406986&w=2 · Aviso do Fabricante