PT-2008-4866 · Microsoft · Office+4

Wushi · Published 2008-10-14 · Updated 2022-02-09 · CVE-2008-3471

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Excel versions 2000 SP3, 2002 SP3, 2003 SP2 and SP3, and 2007 Gold and SP1 Office Excel Viewer 2003 SP3 Office Excel Viewer Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1 Office 2004 and 2008 for Mac Open XML File Format Converter for Mac

Description The issue is related to a stack-based buffer overflow that allows remote attackers to execute arbitrary code via a BIFF file with a malformed record. This is triggered by a user-influenced size calculation. A remote code execution vulnerability exists due to improper memory allocation when loading Excel objects, which could allow an attacker to take complete control of an affected system if a user opens a specially crafted Excel file.

Recommendations For Microsoft Excel 2000 SP3, update to a newer version to mitigate the risk. For Microsoft Excel 2002 SP3, update to a newer version to mitigate the risk. For Microsoft Excel 2003 SP2 and SP3, update to a newer version to mitigate the risk. For Microsoft Excel 2007 Gold and SP1, update to a newer version to mitigate the risk. For Office Excel Viewer 2003 SP3, update to a newer version to mitigate the risk. For Office Excel Viewer, update to a newer version to mitigate the risk. For Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1, update to a newer version to mitigate the risk. For Office 2004 and 2008 for Mac, update to a newer version to mitigate the risk. For Open XML File Format Converter for Mac, update to a newer version to mitigate the risk. As a temporary workaround, consider avoiding the use of BIFF files with malformed records until a patch is available.

Fix

RCE

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2008-3471

Affected Products

Office Excel

Office

Office Compatibility Pack For Word

Office Excel Viewer

Open Xml File Format Converter For Mac

References · 15

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-057 · Vendor Advisory
• http://secunia.com/advisories/32211 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3471 · Security Note
• http://marc.info/?l=bugtraq&m=122479227205998&w=2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-3471 · Security Note
• http://securityfocus.com/bid/31705 · Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45579 · Note
• http://zerodayinitiative.com/advisories/ZDI-08-068 · Note
• http://vupen.com/english/advisories/2008/2808 · Note
• http://securitytracker.com/id?1021044 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45581 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3471 · Note
• http://us-cert.gov/cas/techalerts/TA08-288A.html · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS08-057 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5750 · Note