PT-2008-6039 · Microsoft · Word 97+2

Securfrog · Publicado 2008-12-10 · Atualizado 2019-02-26 · CVE-2008-4841

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the patchday that contains the fix for this issue

Description A remote code execution issue exists in the way that Microsoft WordPad processes memory when parsing a specially crafted Word 97 document. This could allow remote code execution if a user opens a specially crafted Word file that includes a malformed list structure. The issue has been exploited in the wild.

Recommendations As a temporary workaround, consider disabling the WordPad Text Converter for Word 97 files until a patch is available. Restrict access to Word 97 files to minimize the risk of exploitation. Avoid using WordPad to open untrusted Word 97 documents until the issue is resolved.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2008-4841

Produtos afetados

Windows

Wordpad

Word 97

Referências · 16

• 🔥 http://milw0rm.com/sploits/2008-crash.doc.rar · Exploit
• 🔥 https://exploit-db.com/exploits/6560 · Exploit
• http://securityreason.com/securityalert/4711 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6050 · Nota
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS09-010 · Nota
• http://vupen.com/english/advisories/2008/3390 · Nota
• http://securityfocus.com/bid/32718 · Nota
• http://securitytracker.com/id?1021376 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-010 · Aviso do Fabricante
• http://microsoft.com/technet/security/advisory/960906.mspx · Aviso do Fabricante
• http://secunia.com/advisories/32997 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-4841 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4841 · Nota de Segurança
• http://vupen.com/english/advisories/2009/1024 · Nota
• http://securityfocus.com/bid/31399 · Nota