PT-2008-1767 · Microsoft · Office Excel+1

Yoshiya Sasaki · Published 2008-03-11 · Updated 2018-10-12 · CVE-2008-0112

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Excel versions 2000 SP3 Office for Mac versions 2004 and 2008

Description The issue allows remote attackers to execute arbitrary code via a crafted .SLK file that is not properly handled when importing the file. This can occur when an attacker sends a malformed .slk file, which could be hosted on a specially crafted or compromised Web site, or included as an e-mail attachment, and then imports it into Excel.

Recommendations For Microsoft Excel 2000 SP3, consider avoiding the import of .SLK files from untrusted sources until a fix is available. For Office for Mac 2004 and 2008, restrict the import of .SLK files to trusted sources to minimize the risk of exploitation.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2008-0112

Affected Products

Office Excel

Office For Mac

References · 12

• 🔥 https://exploit-db.com/exploits/5287 · Exploit
• http://marc.info/?l=bugtraq&m=120585858807305&w=2 · Vendor Advisory
• http://securityfocus.com/bid/28095 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2008-0112 · Security Note
• http://us-cert.gov/cas/techalerts/TA08-071A.html · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0112 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-014 · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5284 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0112 · Note
• http://securitytracker.com/id?1019583 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS08-014 · Note
• http://vupen.com/english/advisories/2008/0846/references · Note