PT-2008-2687 · Microsoft · Office Visio

Published 2008-04-08 · Updated 2018-10-12 · CVE-2008-1089

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Visio versions 2002 SP2, 2003 SP2 and SP3, and 2007 up to SP1

Description The issue allows remote attackers to execute arbitrary code via a Visio file containing crafted object header data. A remote code execution vulnerability exists in the way Microsoft Visio validates object header data in specially crafted files. An attacker could exploit the vulnerability by sending a malformed file, which could be included as an e-mail attachment, or hosted on a specially crafted or compromised Web site. If a user were logged on with administrative user rights, an attacker who successfully exploited this issue could take complete control of an affected system, allowing them to install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights on the system could be less affected than users who operate with administrative user rights.

Recommendations For Microsoft Visio 2002 SP2, consider applying the recommended patch to resolve the issue. For Microsoft Visio 2003 SP2 and SP3, apply the recommended patch to fix the vulnerability. For Microsoft Visio 2007 up to SP1, apply the recommended patch to resolve the issue. As a temporary workaround, consider restricting the use of Visio files from untrusted sources until a patch is available.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2008-1089

Affected Products

Office Visio

References · 12

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1089 · Security Note
• http://securityfocus.com/bid/28555 · Patch
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-019 · Vendor Advisory
• http://secunia.com/advisories/29691 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1089 · Security Note
• http://marc.info/?l=bugtraq&m=120845064910729&w=2 · Vendor Advisory
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS08-019 · Note
• http://vupen.com/english/advisories/2008/1143/references · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5496 · Note
• http://us-cert.gov/cas/techalerts/TA08-099A.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41451 · Note
• http://securitytracker.com/id?1019804 · Note