PT-2007-1691 · Microsoft · Works Suite+3

Published 2007-02-13 · Updated 2018-10-12 · CVE-2007-0208

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Word in Office versions 2000 SP3 through 2003 SP2 Microsoft Works Suite versions 2004 through 2006 Microsoft Office 2004 for Mac

Description A remote code execution issue exists in Microsoft Word, allowing attackers to execute arbitrary code if a user opens a malicious document. This could enable an attacker to take complete control of an affected system, install programs, view, change, or delete data, or create new accounts with full user rights. The impact may be less severe for users with limited system privileges compared to those with administrative rights.

Recommendations For Microsoft Word in Office versions 2000 SP3 through 2003 SP2, update to a newer version that includes the fix for this issue. For Microsoft Works Suite versions 2004 through 2006, update to a newer version that includes the fix for this issue. For Microsoft Office 2004 for Mac, update to a newer version that includes the fix for this issue. As a temporary workaround, consider disabling the execution of macros in Microsoft Word until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2007-0208

Affected Products

Office 2004 For Mac

Office Word

Works Suite

Office

References · 12

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0208 · Security Note
• http://vupen.com/english/advisories/2007/0583 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-014 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-0208 · Security Note
• https://docs.microsoft.com/security-updates/securitybulletins/2007/MS07-014 · Note
• http://securityfocus.com/bid/22477 · Note
• http://us-cert.gov/cas/techalerts/TA07-044A.html · Note
• http://securitytracker.com/id?1017639 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A700 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0208 · Note
• http://osvdb.org/34385 · Note
• http://frsirt.com/english/advisories/2007/0583 · Note