PT-2008-4435 · Microsoft · Office Excel 2007+1

Published 2008-08-12 · Updated 2018-10-12 · CVE-2008-3003

Positive Technologies (AI Summary)

CVSS v2.0

6.6

Medium

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Office Excel 2007 Gold and SP1

Description The issue allows local users to obtain sensitive information and gain access to a remote data source. This is due to the improper deletion of the PWD string from connections.xml when a .xlsx file is configured not to save the remote data session password. An elevation of privilege exists when data connections are made to remote data sources, potentially allowing an attacker to gain access to a secured remote data source by opening a specially configured .xlsx file.

Recommendations For Microsoft Office Excel 2007 Gold and SP1, consider disabling the ability to open .xlsx files that have been configured not to store credentials to remote data sources until a fix is available. Restrict access to sensitive remote data sources to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-3003

Affected Products

Office Excel 2007

Office Excel

References · 11

• http://secunia.com/advisories/31454 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3003 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2008-3003 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-043 · Vendor Advisory
• http://vupen.com/english/advisories/2008/2347 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=121915960406986&w=2 · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5951 · Note
• http://us-cert.gov/cas/techalerts/TA08-225A.html · Note
• http://securitytracker.com/id?1020669 · Note
• http://securityfocus.com/bid/30641 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS08-043 · Note