PT-2008-3739 · Microsoft · Office Word

Published 2008-07-09 · Updated 2017-09-29 · CVE-2008-2244

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Microsoft Office Word 2002 SP3

Description: A remote code execution issue exists in the way Microsoft Word handles specially crafted Word files, which could allow an attacker to take complete control of an affected system if a user opens a maliciously crafted file. This issue has been exploited in the wild. An attacker could then install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations: For Microsoft Office Word 2002 SP3, avoid opening specially crafted Word files until a fix is available. As a temporary workaround, consider restricting the use of Microsoft Word to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2008-2244

Affected Products

Office Word

References · 14

• http://secunia.com/advisories/30975 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=121915960406986&w=2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2244 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2244 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5897 · Note
• http://securitytracker.com/id?1020447 · Note
• http://vupen.com/english/advisories/2008/2028 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS08-042 · Note
• http://microsoft.com/technet/security/advisory/953635.mspx · Note
• http://securityfocus.com/bid/30124 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43663 · Note
• http://us-cert.gov/cas/techalerts/TA08-225A.html · Note
• http://isc.sans.org/diary.html?storyid=4696 · Note
• http://blogs.technet.com/msrc/archive/2008/07/08/vulnerability-in-microsoft-word-could-allow-remote-code-execution.aspx · Note