PT-2008-5346 · Microsoft · Office Word+7

Aaron Portnoy · Published 2008-12-10 · Updated 2018-10-30 · CVE-2008-4031

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office Word versions 2000 SP3 through 2007 SP1 Outlook 2007 versions Gold through SP1 Word Viewer 2003 versions Gold through SP3 Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats versions Gold through SP1 Office 2004 and 2008 for Mac Open XML File Format Converter for Mac

Description A remote code execution issue exists in the way Microsoft Office handles specially crafted Rich Text Format (RTF) files. This could allow remote code execution if a user opens a specially crafted RTF file in Word, or reads or previews a specially crafted e-mail sent in the RTF format. An attacker who successfully exploits this issue could take control of an affected system in the context of the currently logged-on user, potentially installing programs, viewing, changing, or deleting data, or creating new accounts with full user rights.

Recommendations For Microsoft Office Word 2000 SP3, update to a newer version to mitigate the risk. For Microsoft Office Word 2002 SP3, update to a newer version to mitigate the risk. For Microsoft Office Word 2003 SP3, update to a newer version to mitigate the risk. For Microsoft Office Word 2007 Gold and SP1, update to a newer version to mitigate the risk. For Outlook 2007 Gold and SP1, update to a newer version to mitigate the risk. For Word Viewer 2003 Gold and SP3, update to a newer version to mitigate the risk. For Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1, update to a newer version to mitigate the risk. For Office 2004 and 2008 for Mac, update to a newer version to mitigate the risk. For Open XML File Format Converter for Mac, update to a newer version to mitigate the risk.

Fix

RCE

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2008-4031

Affected Products

Office Word

Office 2004 For Mac

Office 2008 For Mac

Office Compatibility Pack For Word

Open Xml File Format Converter For Mac

Outlook

Outlook 2007

Word Viewer 2003

References · 8

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4031 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-072 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-4031 · Security Note
• http://securitytracker.com/id?1021370 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS08-072 · Note
• http://vupen.com/english/advisories/2008/3384 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5952 · Note
• http://us-cert.gov/cas/techalerts/TA08-344A.html · Note