PT-2008-6039 · Microsoft · Word 97+2

Securfrog · Published 2008-12-10 · Updated 2019-02-26 · CVE-2008-4841

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the patchday that contains the fix for this issue

Description A remote code execution issue exists in the way that Microsoft WordPad processes memory when parsing a specially crafted Word 97 document. This could allow remote code execution if a user opens a specially crafted Word file that includes a malformed list structure. The issue has been exploited in the wild.

Recommendations As a temporary workaround, consider disabling the WordPad Text Converter for Word 97 files until a patch is available. Restrict access to Word 97 files to minimize the risk of exploitation. Avoid using WordPad to open untrusted Word 97 documents until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2008-4841

Affected Products

Windows

Wordpad

Word 97

References · 16

• 🔥 http://milw0rm.com/sploits/2008-crash.doc.rar · Exploit
• 🔥 https://exploit-db.com/exploits/6560 · Exploit
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-010 · Vendor Advisory
• http://microsoft.com/technet/security/advisory/960906.mspx · Vendor Advisory
• http://secunia.com/advisories/32997 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-4841 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4841 · Security Note
• http://securityreason.com/securityalert/4711 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6050 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS09-010 · Note
• http://vupen.com/english/advisories/2008/3390 · Note
• http://securityfocus.com/bid/32718 · Note
• http://securitytracker.com/id?1021376 · Note
• http://vupen.com/english/advisories/2009/1024 · Note
• http://securityfocus.com/bid/31399 · Note