PT-2008-4443 · Microsoft · Vista+21

Published 2008-09-10 · Updated 2018-10-30 · CVE-2008-3012

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer 6 SP1 Windows XP SP2 and SP3 Server 2003 SP1 and SP2 Vista Gold and SP1 Server 2008 Office XP SP3 Office 2003 SP2 and SP3 2007 Microsoft Office System Gold and SP1 Visio 2002 SP2 PowerPoint Viewer 2003 Works 8 Digital Image Suite 2006 SQL Server 2000 Reporting Services SP2 SQL Server 2005 SP2 Report Viewer 2005 SP1 and 2008 Forefront Client Security 1.0

Description A remote code execution issue exists in the way GDI+ handles memory allocation. This could allow remote code execution if a user opens a specially crafted EMF image file or browses to a Web site that contains specially crafted content. An attacker who successfully exploits this issue could take complete control of an affected system, then install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Recommendations For Microsoft Internet Explorer 6 SP1, update to a newer version to mitigate the risk. For Windows XP SP2 and SP3, apply the recommended patch. For Server 2003 SP1 and SP2, install the latest security update. For Vista Gold and SP1, apply the necessary patch. For Server 2008, update to the latest service pack. For Office XP SP3, Office 2003 SP2 and SP3, and 2007 Microsoft Office System Gold and SP1, apply the recommended security update. For Visio 2002 SP2, PowerPoint Viewer 2003, Works 8, Digital Image Suite 2006, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2, Report Viewer 2005 SP1 and 2008, and Forefront Client Security 1.0, install the latest available patch. As a temporary workaround, consider avoiding the use of GDI+ to handle EMF image files until a patch is available.

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2008-3012

Affected Products

2007 Microsoft Office System

Digital Image Suite 2006

Forefront Client Security

Internet Explorer

Internet Explorer 6

Sql Server

Office

Office 2003

Office Visio

Office Xp

Powerpoint Viewer 2003

Report Viewer 2005

Report Viewer 2008

Sql Server 2000

Sql Server 2005

Server 2003

Server 2008

Visio 2002

Vista

Windows

Windows Xp

Works 8

References · 12

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3012 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-052 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-3012 · Security Note
• http://marc.info/?l=bugtraq&m=122235754013992&w=2 · Vendor Advisory
• http://vupen.com/english/advisories/2008/2696 · Note
• http://securityfocus.com/bid/31019 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS08-052 · Note
• http://secunia.com/advisories/32154 · Note
• http://vupen.com/english/advisories/2008/2520 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6040 · Note
• http://us-cert.gov/cas/techalerts/TA08-253A.html · Note
• http://securitytracker.com/id?1020835 · Note