Microsoft Office Excel contains an array-indexing error that is triggered as FORMAT records are not properly validated. With a specially crafted Excel file, a context-dependent attacker can cause data to be written to an arbitrary memory location, allowing arbitrary code execution.

Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released a patch to address this vulnerability.

• Security Tracker: 1020671
• CVE ID: 2008-3005 (see also: NVD)
• Bugtraq ID: 30639
• Secunia Advisory ID: 31454
• Related OSVDB ID: 47407 47409 47410
• Microsoft Knowledge Base Article: 954066
• VUPEN Advisory: ADV-2008-2347 [ Link is 404 ]
• Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2008-08/0160.html
• Other Advisory URL: http://contagiodump.blogspot.com/2009/12/dec-28-cve-2008-3005-excel-russia.html
  http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=741
  http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=741
  http://www.virustotal.com/file-scan/report.html?id=afe6b95ad95bc689c356f34ec8d9094c495e4af57c932ac413b65ef132063acc-1282650856
• News Article: http://www.eweek.com/c/a/Security/Microsoft-Patch-Tuesday-Targets-26-Vulnerabilities/
• Generic Exploit URL: http://www.saintcorporation.com/cgi-bin/exploit_info/excel_format_array_index
• Microsoft Security Bulletin: MS08-043

• Anonymous - iDefense Labs VCP