PT-2008-3022 · Microsoft · Office Compatibility Pack For Word+2

Published 2008-08-12 · Updated 2018-10-30 · CVE-2008-1455

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Office PowerPoint versions 2000 SP3 through 2007 SP1 Office Compatibility Pack for Word, Excel, and PowerPoint 2007 through SP1 Office 2004 for Mac

Description A memory calculation error in Microsoft Office PowerPoint allows remote attackers to execute arbitrary code via a PowerPoint file with crafted list values that trigger memory corruption. The vulnerability can be exploited by creating a specially crafted PowerPoint file that could be included as an e-mail attachment or hosted on a specially crafted or compromised Web site. If successfully exploited, an attacker could take complete control of an affected system, allowing them to install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Office PowerPoint versions 2000 SP3 through 2007 SP1, update to a version that includes the fix for this issue. For Office Compatibility Pack for Word, Excel, and PowerPoint 2007 through SP1, update to a version that includes the fix for this issue. For Office 2004 for Mac, update to a version that includes the fix for this issue. As a temporary workaround, consider avoiding the use of crafted PowerPoint files until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2008-1455

Affected Products

Office Powerpoint

Office 2004 For Mac

Office Compatibility Pack For Word

References · 11

• http://marc.info/?l=bugtraq&m=121915960406986&w=2 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1455 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2008-1455 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-051 · Vendor Advisory
• http://secunia.com/advisories/31453 · Vendor Advisory
• http://vupen.com/english/advisories/2008/2355 · Note
• http://securityfocus.com/bid/30579 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS08-051 · Note
• http://securitytracker.com/id?1020676 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5555 · Note
• http://us-cert.gov/cas/techalerts/TA08-225A.html · Note