PT-2009-1538 · Microsoft · Word 2007

Published 2009-02-05 · Updated 2018-10-11 · CVE-2008-6063

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Word 2007

Description The issue allows remote attackers to obtain sensitive information, such as the sender's account name and a Temporary Internet Files subdirectory name, when the "Save as PDF" add-on is enabled and an "Email as PDF" operation is performed. This occurs because Microsoft Word 2007 places an absolute pathname in the Subject field.

Recommendations For Microsoft Word 2007, consider disabling the "Save as PDF" add-on to prevent sensitive information disclosure until a fix is available. Restrict the use of the "Email as PDF" operation to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2008-6063

Affected Products

Word 2007

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2008-6063 · Security Note
• http://securityfocus.com/archive/1/486088/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6063 · Note