PT-2008-5341 · Microsoft · Office Word+4

Published 2008-12-10 · Updated 2018-10-30 · CVE-2008-4026

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office Word versions 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1 Word Viewer 2003 Gold and SP3 Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1 Office 2004 and 2008 for Mac Open XML File Format Converter for Mac

Description A remote code execution issue exists due to the way Word handles specially crafted Word files. This could allow remote code execution if a user opens a specially crafted Word file with a malformed value. The impact may be less severe for users with limited system privileges compared to those with administrative rights.

Recommendations For Microsoft Office Word 2000 SP3, update to a version that is not affected by this issue. For Microsoft Office Word 2002 SP3, update to a version that is not affected by this issue. For Microsoft Office Word 2003 SP3, update to a version that is not affected by this issue. For Microsoft Office Word 2007 Gold and SP1, update to a version that is not affected by this issue. For Word Viewer 2003 Gold and SP3, update to a version that is not affected by this issue. For Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1, update to a version that is not affected by this issue. For Office 2004 and 2008 for Mac, update to a version that is not affected by this issue. For Open XML File Format Converter for Mac, update to a version that is not affected by this issue. As a temporary workaround, consider avoiding the use of malformed Word files until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2008-4026

Affected Products

Office Word

Office

Office Compatibility Pack For Word

Open Xml File Format Converter For Mac

Word Viewer

References · 8

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4026 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2008-4026 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-072 · Vendor Advisory
• http://securitytracker.com/id?1021370 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS08-072 · Note
• http://vupen.com/english/advisories/2008/3384 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5807 · Note
• http://us-cert.gov/cas/techalerts/TA08-344A.html · Note