PT-2008-2686 · Microsoft · Office Project

Published 2008-04-08 · Updated 2018-10-12 · CVE-2008-1088

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Project versions 2000 Service Release 1, 2002 SP1, 2003 SP2

Description The issue allows user-assisted remote attackers to execute arbitrary code via a crafted Project file, related to improper validation of memory resource allocations.

Recommendations For Microsoft Project 2000 Service Release 1, 2002 SP1, and 2003 SP2, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2008-1088

Affected Products

Office Project

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2008-1088 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-018 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=120845064910729&w=2 · Vendor Advisory
• http://secunia.com/advisories/29690 · Vendor Advisory
• http://securityfocus.com/bid/28607 · Patch
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5384 · Note
• http://kb.cert.org/vuls/id/155563 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41447 · Note
• http://securitytracker.com/id?1019797 · Note
• http://us-cert.gov/cas/techalerts/TA08-099A.html · Note
• http://vupen.com/english/advisories/2008/1142/references · Note