45031 : Microsoft Office RTF File Handling Object Parsing Arbitrary Code Execution
Printer | http://osvdb.org/45031 | Email This | Edit Vulnerability

Views This Week

44

Views All Time

361

Info

Last Modified

23 days ago

Percent Complete

100%

Disclosure

May 13, 2008

Discovery

Unknown

Dates

Exploit

Unknown

Solution

May 13, 2008

Description

A memory corruption flaw exists in Office. Word and Outlook fail to validate strings contained in RTF files resulting in memory corruption. With a specially crafted file, a context-dependent attacker can cause arbitrary code execution resulting in a loss of integrity.

Classification

Location: Local Access Required, Remote/Network Access Required
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Patch
Exploit: Exploit Unknown
Disclosure: Coordinated Disclosure
OSVDB: Context Dependent

Solution

Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released a patch to address this vulnerability.

Products

Microsoft Corporation
Watch-list
Office
Watch-list
2004 for Mac
2008 for Mac
Word
Watch-list
2002 SP3
2000 SP3
2003 SP2
2003 SP3
2007
2007 SP1
Outlook
Watch-list
2007
2007 SP1
Office Compatibility Pack for Word, Excel and Powerpoint
Watch-list
2007
2007 SP1

References

Tools & Filters

Nessus

32310

Credit

  • wushi - team509

Blogs

2008/05/19 14:00:47 | Microsoft released patches vulnerabilities

from: The technological era

— Microsoft has released in May this year, the number of vulnerabilities patch, ... proposed the broad masses of computer users should pay special attention to MS08-026, MS07-027

2008/05/13 17:34:07 | Microsoft plugs Office leaks; Delivers 4 critical patches

from: New Digital Computer —

Microsoft plugs Office leaks; Delivers 4 critical patches in: Uncategorized Microsoft on Tuesday delivered four critical patches for vulnerabilities Office and Windows XP. There were six patches delivered. Here's a look by the CVE: CVE-2008-1091: Microsoft

2008/05/15 07:19:19 | Four Vulnerabilities Patched By Microsoft

from: gadget life blog

Four Vulnerabilities Patched By Microsoft Posted by: in PC Guide Microsoft issued security bulletins and patched for four vulnerabilities today ... out at moderate. The first bulletin, MS08-026, describes two vulnerabilities in Microsoft Word

2008/05/14 20:22:00 | Patch the big new Microsoft Word security vulnerability

from: Z Trek: The Alan Zeichick Weblog

Yesterday, Microsoft released a series of patches to Microsoft Office — for both Windows and Macintosh — that plugged a serious Remote Code Execution flaw in Word and Outlook. As detailed in Microsoft Security Bulletin MS08-026, which is rated as "critical": This security update resolves several privately reported vulnerabilities in Microsoft

2008/05/14 01:40:00 | No Security Update for Vista this month

from: Donna's SecurityFlash

Microsoft released their monthly Security Updates this month. There's no security update for Vista today ... Forefront Security MS08-026 - Vulnerabilities in Microsoft Word Could Allow Remote Code Execution ... that MS08-026 includes additional security mitigations against attacks as identified in Microsoft Security

2008/05/14 07:52:58 | Microsoft Sent Patches for Windows, Word Flaws

from: Enterprise Blog

Microsoft Sent Patches for Windows, Word Flaws May 14th, 2008 Microsoft fixed six vulnerabilities which are critical for Windows, Word, ... partner Tags: Jet Database engine, Microsoft, MS08-026, MS08-027, MS08-028, MS08-029, Patch

Comments

No Comments.

DONATE NOW!

User Status

Quick Searches

Advertisements

The database information may change without any notice. Use of the information constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the copyright holder or distributor (OSVDB or OSF) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

© Copyright 2008 Open Source Vulnerability Database (OSVDB), All Rights Reserved.
Privacy Statement - Terms of Use