PT-2008-4449 · Microsoft · Office Converter Pack+3
Publicado
2008-08-12
·
Atualizado
2018-10-12
·
CVE-2008-3020
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Microsoft Office versions 2000 SP3 through XP SP3
Office Converter Pack (affected versions not specified)
Works version 8
Description
A remote code execution issue exists in the way Microsoft Office handles BMP format image files. This could be exploited when a Microsoft Office application opens a specially crafted BMP-format image file, potentially included as an e-mail attachment or hosted on a malicious Web site. An attacker who successfully exploits this issue could take complete control of an affected system, but significant user interaction is required.
Recommendations
For Microsoft Office versions 2000 SP3 through XP SP3, update to a version that properly parses the length of a BMP file to prevent remote code execution.
For Office Converter Pack, at the moment, there is no information about a newer version that contains a fix for this issue.
For Works version 8, consider disabling the handling of BMP files until a patch is available.
Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Office
Office Converter Pack
Office Project
Works