PT-2008-6038 · Microsoft · Office Word+3

Published 2008-12-10 · Updated 2018-10-30 · CVE-2008-4837

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office Word versions 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1 Microsoft Word Viewer version 2003 Gold and SP3 Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats versions Gold and SP1 Microsoft Works version 8

Description A remote code execution issue exists in the way Microsoft Office Word handles specially crafted Word files, potentially allowing an attacker to execute arbitrary code via a crafted Word document containing a malformed table property or record value. This could enable an attacker to take control of an affected system, install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Office Word versions 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1, update to a newer version to mitigate the risk. For Microsoft Word Viewer version 2003 Gold and SP3, update to a newer version to mitigate the risk. For Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats versions Gold and SP1, update to a newer version to mitigate the risk. For Microsoft Works version 8, update to a newer version to mitigate the risk.

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2008-4837

Affected Products

Office Word

Word Viewer

Works

Office Compatibility Pack For Word

References · 10

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4837 · Security Note
• http://vupen.com/english/advisories/2008/3384 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-072 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-4837 · Security Note
• http://securitytracker.com/id?1021370 · Note
• http://securityfocus.com/archive/1/499064/100/0/threaded · Note
• http://zerodayinitiative.com/advisories/ZDI-08-086 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS08-072 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5982 · Note
• http://us-cert.gov/cas/techalerts/TA08-344A.html · Note