PT-2008-5537 · Microsoft · Office Frontpage 2002+4

Published 2008-12-10 · Updated 2018-10-12 · CVE-2008-4253

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Microsoft Visual Basic 6.0 Visual FoxPro versions 8.0 SP1 through 9.0 SP2 Office FrontPage 2002 SP3 Office Project 2003 SP3

Description: The issue arises from the FlexGrid ActiveX control's failure to properly handle errors when accessing incorrectly initialized objects. This allows remote attackers to execute arbitrary code via a crafted HTML document, potentially corrupting the system state. An attacker could exploit this by constructing a specially crafted Web page, which when viewed by a user, could allow remote code execution. The attacker could gain the same user rights as the logged-on user.

Recommendations: For Microsoft Visual Basic 6.0, update to a version that includes the fix for the FlexGrid ActiveX control issue. For Visual FoxPro versions 8.0 SP1 through 9.0 SP2, apply the necessary patch to resolve the FlexGrid ActiveX control vulnerability. For Office FrontPage 2002 SP3 and Office Project 2003 SP3, consider disabling the FlexGrid ActiveX control as a temporary workaround until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2008-4253

Affected Products

Visual Basic 6.0

Office Frontpage 2002

Office Project

Office Project 2003

Visual Foxpro

References · 11

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4253 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2008-4253 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-070 · Vendor Advisory
• http://securityfocus.com/bid/32592 · Note
• http://vupen.com/english/advisories/2008/3382 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5994 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4253 · Note
• http://securitytracker.com/id?1021369 · Note
• http://us-cert.gov/cas/techalerts/TA08-344A.html · Note
• http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm · Note
• http://technet.microsoft.com/en-us/library/security/ms08-070 · Note