PT-2008-4872 · Microsoft · Office Excel
Joshua J. Drake
+1
·
Publicado
2008-10-14
·
Atualizado
2023-12-07
·
CVE-2008-3477
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Microsoft Excel versions 2000 SP3, 2002 SP3, and 2003 SP2 and SP3
Description
The issue arises from improper validation of data in the VBA Performance Cache when processing an Office document with an embedded object. This allows remote attackers to execute arbitrary code via a crafted Excel file, leading to heap-based buffer overflows, integer overflows, array index errors, and memory corruption. A remote code execution vulnerability exists in the way Excel processes a VBA Performance Cache, which could allow an attacker to take complete control of an affected system if a user opens a specially crafted Excel file.
Recommendations
For Microsoft Excel 2000 SP3, update to a version that properly validates data in the VBA Performance Cache to prevent remote code execution.
For Microsoft Excel 2002 SP3, update to a version that properly validates data in the VBA Performance Cache to prevent remote code execution.
For Microsoft Excel 2003 SP2 and SP3, update to a version that properly validates data in the VBA Performance Cache to prevent remote code execution.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Office Excel