ID CVE-2008-3471
Summary Stack-based buffer overflow in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2 and SP3, and 2007 Gold and SP1; Office Excel Viewer 2003 SP3; Office Excel Viewer; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via a BIFF file with a malformed record that triggers a user-influenced size calculation, aka "File Format Parsing Vulnerability."
References
Vulnerable Configurations
  • cpe:2.3:a:microsoft:excel:2003:sp2:*:*:*:*:*:*
    cpe:2.3:a:microsoft:excel:2003:sp2:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:excel:2003:sp3:*:*:*:*:*:*
    cpe:2.3:a:microsoft:excel:2003:sp3:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:excel:2007:-:*:*:*:*:*:*
    cpe:2.3:a:microsoft:excel:2007:-:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:excel:2007:sp1:*:*:*:*:*:*
    cpe:2.3:a:microsoft:excel:2007:sp1:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:excel_viewer:-:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:excel_viewer:-:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:excel_viewer:2003:-:*:*:*:*:*:*
    cpe:2.3:a:microsoft:excel_viewer:2003:-:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:excel_viewer:2003:sp3:*:*:*:*:*:*
    cpe:2.3:a:microsoft:excel_viewer:2003:sp3:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:office:2004:*:*:*:*:macos:*:*
    cpe:2.3:a:microsoft:office:2004:*:*:*:*:macos:*:*
  • cpe:2.3:a:microsoft:office:2008:*:*:*:*:macos:*:*
    cpe:2.3:a:microsoft:office:2008:*:*:*:*:macos:*:*
  • cpe:2.3:a:microsoft:office_compatibility_pack:2007:-:*:*:*:*:*:*
    cpe:2.3:a:microsoft:office_compatibility_pack:2007:-:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:office_compatibility_pack:2007:sp1:*:*:*:*:*:*
    cpe:2.3:a:microsoft:office_compatibility_pack:2007:sp1:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:open_xml_file_format_converter:-:*:*:*:*:macos:*:*
    cpe:2.3:a:microsoft:open_xml_file_format_converter:-:*:*:*:*:macos:*:*
CVSS
Base: 9.3 (as of 09-02-2022 - 19:22)
Impact:
Exploitability:
CWE CWE-787
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:M/Au:N/C:C/I:C/A:C
oval via4
accepted 2014-06-30T04:11:05.461-04:00
class vulnerability
contributors
  • name Sudhir Gandhe
    organization Secure Elements, Inc.
  • name Dragos Prisaca
    organization Gideon Technologies, Inc.
  • name Shane Shaffer
    organization G2, Inc.
  • name Josh Turpin
    organization Symantec Corporation
  • name Maria Kedovskaya
    organization ALTX-SOFT
  • name Maria Mikhno
    organization ALTX-SOFT
definition_extensions
  • comment Microsoft Excel 2000 is installed
    oval oval:org.mitre.oval:def:758
  • comment Microsoft Excel 2002 is installed
    oval oval:org.mitre.oval:def:473
  • comment Microsoft Excel 2003 is installed
    oval oval:org.mitre.oval:def:764
  • comment Microsoft Excel 2007 is installed
    oval oval:org.mitre.oval:def:1745
  • comment Microsoft Excel Viewer 2003 is installed
    oval oval:org.mitre.oval:def:439
  • comment Microsoft Excel Viewer 2007 is installed
    oval oval:org.mitre.oval:def:6006
  • comment Microsoft Office Compatibility Pack is installed
    oval oval:org.mitre.oval:def:1853
description Stack-based buffer overflow in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2 and SP3, and 2007 Gold and SP1; Office Excel Viewer 2003 SP3; Office Excel Viewer; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via a BIFF file with a malformed record that triggers a user-influenced size calculation, aka "File Format Parsing Vulnerability."
family windows
id oval:org.mitre.oval:def:5750
status accepted
submitted 2008-10-14T13:33:00
title File Format Parsing Vulnerability
version 28
refmap via4
bid 31705
cert TA08-288A
hp
  • HPSBST02379
  • SSRT080143
misc http://www.zerodayinitiative.com/advisories/ZDI-08-068/
sectrack 1021044
secunia 32211
vupen ADV-2008-2808
xf
  • excel-file-format-code-execution(45579)
  • win-ms08kb956416-update(45581)
Last major update 09-02-2022 - 19:22
Published 15-10-2008 - 00:12
Last modified 09-02-2022 - 19:22
Back to Top