PT-2008-3928 · Microsoft · Office Access+1

Published 2008-07-07 · Updated 2017-09-29 · CVE-2008-2463

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Microsoft Office Access versions 2000 through 2003 Microsoft Office Snapshot Viewer version 10.0.5529.0

Description: A remote code execution issue exists in the ActiveX control for the Snapshot Viewer, allowing attackers to download arbitrary files to a client machine via a crafted HTML document or e-mail message. This is likely related to the use of the SnapshotPath and CompressedPath properties and the PrintSnapshot method. The issue can be leveraged for code execution by writing to a Startup folder. An attacker who successfully exploits this issue could gain the same user rights as the logged-on user.

Recommendations: For Microsoft Office Access versions 2000 through 2003, consider disabling the ActiveX control for the Snapshot Viewer until a patch is available. For Microsoft Office Snapshot Viewer version 10.0.5529.0, restrict access to the PrintSnapshot method and the SnapshotPath and CompressedPath properties to minimize the risk of exploitation.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2008-2463

Affected Products

Office Access

Office Snapshot Viewer

References · 18

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms08_041_snapshotviewer.rb · Exploit
• 🔥 http://exploit-db.com/exploits/6124 · Exploit
• 🔥 https://exploit-db.com/exploits/16605 · Exploit
• 🔥 https://exploit-db.com/exploits/6124 · Exploit
• http://marc.info/?l=bugtraq&m=121915960406986&w=2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2463 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2463 · Security Note
• http://secunia.com/advisories/30883 · Note
• http://securitytracker.com/id?1020433 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS08-041 · Note
• http://us-cert.gov/cas/techalerts/TA08-225A.html · Note
• http://vupen.com/english/advisories/2008/2012/references · Note
• http://microsoft.com/technet/security/advisory/955179.mspx · Note
• http://securityfocus.com/bid/30114 · Note
• http://kb.cert.org/vuls/id/837785 · Note