PT-2008-1772 · Microsoft · Office Excel+1

Dan Hubbard + 1 · Published 2008-03-11 · Updated 2018-10-12 · CVE-2008-0117

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Excel versions 2000 SP3 and 2002 SP2 Microsoft Office versions 2004 and 2008 for Mac

Description The issue allows remote attackers to execute arbitrary code via crafted conditional formatting values. A remote code execution vulnerability exists in the way Excel handles conditional formatting values. An attacker could exploit the vulnerability by sending a malformed file which could be hosted on a specially crafted or compromised Web site, or included as an e-mail attachment.

Recommendations For Microsoft Excel 2000 SP3, update to a version that is not affected by this issue. For Microsoft Excel 2002 SP2, update to a version that is not affected by this issue. For Microsoft Office 2004 for Mac, update to a version that is not affected by this issue. For Microsoft Office 2008 for Mac, update to a version that is not affected by this issue. As a temporary workaround, consider avoiding the use of conditional formatting values in Excel until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2008-0117

Affected Products

Office Excel

Office

References · 12

• 🔥 https://exploit-db.com/exploits/5287 · Exploit
• http://marc.info/?l=bugtraq&m=120585858807305&w=2 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0117 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2008-0117 · Security Note
• http://us-cert.gov/cas/techalerts/TA08-071A.html · Patch
• http://securityfocus.com/bid/28170 · Patch
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-014 · Vendor Advisory
• http://vupen.com/english/advisories/2008/0846/references · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS08-014 · Note
• http://securitytracker.com/id?1019587 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5508 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0117 · Note