ID |
CVE-2008-4019
|
Summary |
Integer overflow in the REPT function in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2 and SP3, and 2007 Gold and SP1; Office Excel Viewer 2003 SP3; Office Excel Viewer; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; Office SharePoint Server 2007 Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via an Excel file containing a formula within a cell, aka "Formula Parsing Vulnerability." |
References |
|
Vulnerable Configurations |
-
cpe:2.3:a:microsoft:excel:2003:sp2:*:*:*:*:*:*
cpe:2.3:a:microsoft:excel:2003:sp2:*:*:*:*:*:*
-
cpe:2.3:a:microsoft:excel:2003:sp3:*:*:*:*:*:*
cpe:2.3:a:microsoft:excel:2003:sp3:*:*:*:*:*:*
-
cpe:2.3:a:microsoft:excel:2007:-:*:*:*:*:*:*
cpe:2.3:a:microsoft:excel:2007:-:*:*:*:*:*:*
-
cpe:2.3:a:microsoft:excel:2007:sp1:*:*:*:*:*:*
cpe:2.3:a:microsoft:excel:2007:sp1:*:*:*:*:*:*
-
cpe:2.3:a:microsoft:excel_viewer:-:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:excel_viewer:-:*:*:*:*:*:*:*
-
cpe:2.3:a:microsoft:excel_viewer:2003:-:*:*:*:*:*:*
cpe:2.3:a:microsoft:excel_viewer:2003:-:*:*:*:*:*:*
-
cpe:2.3:a:microsoft:excel_viewer:2003:sp3:*:*:*:*:*:*
cpe:2.3:a:microsoft:excel_viewer:2003:sp3:*:*:*:*:*:*
-
cpe:2.3:a:microsoft:office:2004:*:*:*:*:macos:*:*
cpe:2.3:a:microsoft:office:2004:*:*:*:*:macos:*:*
-
cpe:2.3:a:microsoft:office:2008:*:*:*:*:macos:*:*
cpe:2.3:a:microsoft:office:2008:*:*:*:*:macos:*:*
-
cpe:2.3:a:microsoft:office_compatibility_pack:2007:-:*:*:*:*:*:*
cpe:2.3:a:microsoft:office_compatibility_pack:2007:-:*:*:*:*:*:*
-
cpe:2.3:a:microsoft:office_compatibility_pack:2007:sp1:*:*:*:*:*:*
cpe:2.3:a:microsoft:office_compatibility_pack:2007:sp1:*:*:*:*:*:*
-
cpe:2.3:a:microsoft:open_xml_file_format_converter:-:*:*:*:*:macos:*:*
cpe:2.3:a:microsoft:open_xml_file_format_converter:-:*:*:*:*:macos:*:*
-
cpe:2.3:a:microsoft:sharepoint_server:2007:*:*:*:*:*:x64:*
cpe:2.3:a:microsoft:sharepoint_server:2007:*:*:*:*:*:x64:*
-
cpe:2.3:a:microsoft:sharepoint_server:2007:-:*:*:*:*:*:*
cpe:2.3:a:microsoft:sharepoint_server:2007:-:*:*:*:*:*:*
-
cpe:2.3:a:microsoft:sharepoint_server:2007:sp1:*:*:*:*:*:*
cpe:2.3:a:microsoft:sharepoint_server:2007:sp1:*:*:*:*:*:*
-
cpe:2.3:a:microsoft:sharepoint_server:2007:sp1:*:*:*:*:x64:*
cpe:2.3:a:microsoft:sharepoint_server:2007:sp1:*:*:*:*:x64:*
|
CVSS |
Base: | 9.3 (as of 09-02-2022 - 19:22) |
Impact: | |
Exploitability: | |
|
CWE |
CWE-190 |
CAPEC |
-
Forced Integer Overflow
This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code.
|
Access |
Vector | Complexity | Authentication |
NETWORK |
MEDIUM |
NONE |
|
Impact |
Confidentiality | Integrity | Availability |
COMPLETE |
COMPLETE |
COMPLETE |
|
cvss-vector
via4
|
AV:N/AC:M/Au:N/C:C/I:C/A:C
|
oval
via4
|
accepted | 2014-06-30T04:11:15.169-04:00 | class | vulnerability | contributors | name | Sudhir Gandhe | organization | Secure Elements, Inc. |
name | Dragos Prisaca | organization | Gideon Technologies, Inc. |
name | Dragos Prisaca | organization | Symantec Corporation |
name | Akihito Nakamura | organization | AIST |
name | Shane Shaffer | organization | G2, Inc. |
name | Josh Turpin | organization | Symantec Corporation |
name | Maria Kedovskaya | organization | ALTX-SOFT |
name | Maria Mikhno | organization | ALTX-SOFT |
| definition_extensions | comment | Microsoft Excel 2000 is installed | oval | oval:org.mitre.oval:def:758 |
comment | Microsoft Excel 2002 is installed | oval | oval:org.mitre.oval:def:473 |
comment | Microsoft Excel 2003 is installed | oval | oval:org.mitre.oval:def:764 |
comment | Microsoft Excel 2007 is installed | oval | oval:org.mitre.oval:def:1745 |
comment | Microsoft Excel Viewer 2003 is installed | oval | oval:org.mitre.oval:def:439 |
comment | Microsoft Excel Viewer 2007 is installed | oval | oval:org.mitre.oval:def:6006 |
comment | Microsoft Office Compatibility Pack is installed | oval | oval:org.mitre.oval:def:1853 |
comment | Microsoft Office SharePoint Server 2007 is installed. | oval | oval:org.mitre.oval:def:2313 |
| description | Integer overflow in the REPT function in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2 and SP3, and 2007 Gold and SP1; Office Excel Viewer 2003 SP3; Office Excel Viewer; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; Office SharePoint Server 2007 Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via an Excel file containing a formula within a cell, aka "Formula Parsing Vulnerability." | family | windows | id | oval:org.mitre.oval:def:6102 | status | accepted | submitted | 2008-10-14T13:33:00 | title | Formula Parsing Vulnerability | version | 32 |
|
refmap
via4
|
bid | 31706 | cert | TA08-288A | hp | | sectrack | 1021044 | secunia | 32211 | vupen | ADV-2008-2808 | xf | - excel-rept-code-execution(45580)
- win-ms08kb956416-update(45581)
|
|
saint
via4
|
bid | 31706 | description | Microsoft Excel formula parsing integer overflow | id | win_patch_excel2000,win_patch_excel2003,win_patch_excel2007,win_patch_excelcpack,win_patch_excelview,win_patch_excelxp,win_patch_office2004macver,win_patch_office2008macver,win_patch_sharepoint2007 | osvdb | 49078 | title | excel_formula_parsing | type | client |
|
Last major update |
09-02-2022 - 19:22 |
Published |
15-10-2008 - 00:12 |
Last modified |
09-02-2022 - 19:22 |