ID CVE-2003-0820
Summary Microsoft Word 97, 98(J), 2000, and 2002, and Microsoft Works Suites 2001 through 2004, do not properly check the length of the "Macro names" data value, which could allow remote attackers to execute arbitrary code via a buffer overflow attack.
References
Vulnerable Configurations
  • cpe:2.3:a:microsoft:word:97:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:word:97:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:word:97:*:*:ja:*:*:*:*
    cpe:2.3:a:microsoft:word:97:*:*:ja:*:*:*:*
  • cpe:2.3:a:microsoft:word:97:*:*:ko:*:*:*:*
    cpe:2.3:a:microsoft:word:97:*:*:ko:*:*:*:*
  • cpe:2.3:a:microsoft:word:97:*:*:zh:*:*:*:*
    cpe:2.3:a:microsoft:word:97:*:*:zh:*:*:*:*
  • cpe:2.3:a:microsoft:word:97:sr1:*:*:*:*:*:*
    cpe:2.3:a:microsoft:word:97:sr1:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:word:97:sr2:*:*:*:*:*:*
    cpe:2.3:a:microsoft:word:97:sr2:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:word:98:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:word:98:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:word:98:*:*:ja:*:*:*:*
    cpe:2.3:a:microsoft:word:98:*:*:ja:*:*:*:*
  • cpe:2.3:a:microsoft:word:98:*:*:ko:*:*:*:*
    cpe:2.3:a:microsoft:word:98:*:*:ko:*:*:*:*
  • cpe:2.3:a:microsoft:word:98:*:*:zh:*:*:*:*
    cpe:2.3:a:microsoft:word:98:*:*:zh:*:*:*:*
  • cpe:2.3:a:microsoft:word:98:sr1:*:ja:*:*:*:*
    cpe:2.3:a:microsoft:word:98:sr1:*:ja:*:*:*:*
  • cpe:2.3:a:microsoft:word:98:sr2:*:ja:*:*:*:*
    cpe:2.3:a:microsoft:word:98:sr2:*:ja:*:*:*:*
  • cpe:2.3:a:microsoft:word:2000:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:word:2000:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:word:2000:*:*:ja:*:*:*:*
    cpe:2.3:a:microsoft:word:2000:*:*:ja:*:*:*:*
  • cpe:2.3:a:microsoft:word:2000:*:*:ko:*:*:*:*
    cpe:2.3:a:microsoft:word:2000:*:*:ko:*:*:*:*
  • cpe:2.3:a:microsoft:word:2000:*:*:zh:*:*:*:*
    cpe:2.3:a:microsoft:word:2000:*:*:zh:*:*:*:*
  • cpe:2.3:a:microsoft:word:2000:sp2:*:*:*:*:*:*
    cpe:2.3:a:microsoft:word:2000:sp2:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:word:2000:sp3:*:*:*:*:*:*
    cpe:2.3:a:microsoft:word:2000:sp3:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:word:2000:sr1:*:*:*:*:*:*
    cpe:2.3:a:microsoft:word:2000:sr1:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:word:2000:sr1a:*:*:*:*:*:*
    cpe:2.3:a:microsoft:word:2000:sr1a:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:word:2002:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:word:2002:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:word:2002:sp1:*:*:*:*:*:*
    cpe:2.3:a:microsoft:word:2002:sp1:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:word:2002:sp2:*:*:*:*:*:*
    cpe:2.3:a:microsoft:word:2002:sp2:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:works:2001:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:works:2001:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:works:2002:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:works:2002:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:works:2003:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:works:2003:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:works:2004:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:works:2004:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 12-10-2018 - 21:33)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
oval via4
  • accepted 2012-05-28T04:01:39.381-04:00
    class vulnerability
    contributors
    • name Christine Walzer
      organization The MITRE Corporation
    • name Ingrid Skoog
      organization The MITRE Corporation
    • name John Hoyland
      organization Centennial Software
    • name Shane Shaffer
      organization G2, Inc.
    description Microsoft Word 97, 98(J), 2000, and 2002, and Microsoft Works Suites 2001 through 2004, do not properly check the length of the "Macro names" data value, which could allow remote attackers to execute arbitrary code via a buffer overflow attack.
    family windows
    id oval:org.mitre.oval:def:336
    status accepted
    submitted 2003-11-19T12:00:00.000-04:00
    title MS Word 2000 Macro Names Buffer Overflow
    version 6
  • accepted 2016-02-19T10:00:00.000-04:00
    class vulnerability
    contributors
    • name Andrew Buttner
      organization The MITRE Corporation
    • name Ingrid Skoog
      organization The MITRE Corporation
    • name Ingrid Skoog
      organization The MITRE Corporation
    • name Dragos Prisaca
      organization Secure Elements, Inc.
    • name Shane Shaffer
      organization G2, Inc.
    description Microsoft Word 97, 98(J), 2000, and 2002, and Microsoft Works Suites 2001 through 2004, do not properly check the length of the "Macro names" data value, which could allow remote attackers to execute arbitrary code via a buffer overflow attack.
    family windows
    id oval:org.mitre.oval:def:585
    status accepted
    submitted 2003-11-19T12:00:00.000-04:00
    title MS Word 97 Macro Names Buffer Overflow
    version 4
  • accepted 2016-02-19T10:00:00.000-04:00
    class vulnerability
    contributors
    • name Andrew Buttner
      organization The MITRE Corporation
    • name Harvey Rubinovitz
      organization The MITRE Corporation
    • name Shane Shaffer
      organization G2, Inc.
    description Microsoft Word 97, 98(J), 2000, and 2002, and Microsoft Works Suites 2001 through 2004, do not properly check the length of the "Macro names" data value, which could allow remote attackers to execute arbitrary code via a buffer overflow attack.
    family windows
    id oval:org.mitre.oval:def:586
    status accepted
    submitted 2003-11-19T12:00:00.000-04:00
    title MS Word 98 Macro Names Buffer Overflow
    version 4
  • accepted 2012-05-28T04:02:09.735-04:00
    class vulnerability
    contributors
    • name Andrew Buttner
      organization The MITRE Corporation
    • name Ingrid Skoog
      organization The MITRE Corporation
    • name John Hoyland
      organization Centennial Software
    • name Shane Shaffer
      organization G2, Inc.
    description Microsoft Word 97, 98(J), 2000, and 2002, and Microsoft Works Suites 2001 through 2004, do not properly check the length of the "Macro names" data value, which could allow remote attackers to execute arbitrary code via a buffer overflow attack.
    family windows
    id oval:org.mitre.oval:def:668
    status accepted
    submitted 2003-11-19T12:00:00.000-04:00
    title MS Word 2002 Macro Names Buffer Overflow
    version 6
refmap via4
bid 8835
bugtraq 20031015 Few issues previously unpublished in English
misc http://www.security.nnov.ru/search/document.asp?docid=5243
xf word-macro-execute-code(13682)
Last major update 12-10-2018 - 21:33
Published 15-12-2003 - 05:00
Last modified 12-10-2018 - 21:33
Back to Top