| CVE-2008-0116 |
|
发布时间 :2008-03-11 19:44:00 | ||
| 修订时间 :2011-04-18 00:00:00 | ||||
| NMCOPS |
[原文]Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, Compatibility Pack, and Office 2004 and 2008 for Mac allows user-assisted remote attackers to execute arbitrary code via malformed tags in rich text, aka “Excel Rich Text Validation Vulnerability.”
[CNNVD]Microsoft Excel富文本值堆溢出漏洞(CNNVD-200803-171)
Excel是微软Office办公软件家族中的电子表格工具。
Excel在解析BIFF文件格式时存在堆溢出漏洞，成功利用这个漏洞的攻击者可能以当前登录用户的权限执行任意指令。
如果处理了畸形的标签，就可能由用户控制堆分配，在将用户提供的数据拷贝到堆缓冲区时就可以触发这个溢出，覆盖任意内存。
–
CVSS (基础分值)
| CVSS分值: | 9.3 | [严重(HIGH)] |
| 机密性影响: | COMPLETE | [完全的信息泄露导致所有系统文件暴露] |
| 完整性影响: | COMPLETE | [系统完整性可被完全破坏] |
| 可用性影响: | COMPLETE | [可能导致系统完全宕机] |
| 攻击复杂度: | MEDIUM | [漏洞利用存在一定的访问条件] |
| 攻击向量: | NETWORK | [攻击者不需要获取内网访问权或本地访问权] |
| 身份认证: | NONE | [漏洞利用无需身份认证] |
–
CWE (弱点类目)
| CWE-94| CWE-20 |
[] |
–
CPE (受影响的平台与产品)
| cpe:/a:microsoft:excel:2003:sp2 | Microsoft Excel 2003 SP2 |
| cpe:/a:microsoft:office_compatibility_pack_for_word_excel_ppt_2007 | |
| cpe:/a:microsoft:excel:2002:sp3 | Microsoft Office Excel 2002 Service Pack 3 |
| cpe:/a:microsoft:excel_viewer:2003 | Microsoft Excel Viewer 2003 |
| cpe:/a:microsoft:excel:2000:sp3 | Microsoft Excel 2000 Service Pack 3 |
| cpe:/a:microsoft:office:2008::mac | Microsoft Office 2008 Mac |
| cpe:/a:microsoft:office:2004::mac | Microsoft Office 2004 Mac |
–
OVAL (用于检测的技术细节)
| oval:org.mitre.oval:def:5212 | Excel Rich Text Validation Vulnerability |
| *OVAL详细的描述了检测该漏洞的方法，你可以从相关的OVAL定义中找到更多检测该漏洞的技术细节。 | |
–
官方数据库链接
–
其它链接及资源
|
http://www.us-cert.gov/cas/techalerts/TA08-071A.html (PATCH) CERT TA08-071A |
|
http://www.securityfocus.com/bid/28168 (PATCH) BID 28168 |
|
http://www.microsoft.com/technet/security/bulletin/ms08-014.mspx (PATCH) MS MS08-014 |
|
http://www.vupen.com/english/advisories/2008/0846/references (VENDOR_ADVISORY) VUPEN ADV-2008-0846 |
|
http://www.securitytracker.com/id?1019586 (UNKNOWN) SECTRACK 1019586 |
|
http://www.securityfocus.com/archive/1/archive/1/489430/100/0/threaded (UNKNOWN) BUGTRAQ 20080311 TPTI-08-03: Microsoft Excel Rich Text Memory Corruption Vulnerability |
|
http://marc.info/?l=bugtraq&m=120585858807305&w=2 (UNKNOWN) HP HPSBST02320 |
|
http://marc.info/?l=bugtraq&m=120585858807305&w=2 (UNKNOWN) HP HPSBST02320 |
|
http://dvlabs.tippingpoint.com/advisory/TPTI-08-03 (UNKNOWN) MISC http://dvlabs.tippingpoint.com/advisory/TPTI-08-03 |
–
漏洞信息
| Microsoft Excel富文本值堆溢出漏洞 | |
| 高危 | 代码注入 |
| 2008-03-11 00:00:00 | 2009-02-03 00:00:00 |
| 远程 | |
| Excel是微软Office办公软件家族中的电子表格工具。 Excel在解析BIFF文件格式时存在堆溢出漏洞，成功利用这个漏洞的攻击者可能以当前登录用户的权限执行任意指令。 如果处理了畸形的标签，就可能由用户控制堆分配，在将用户提供的数据拷贝到堆缓冲区时就可以触发这个溢出，覆盖任意内存。 |
|
–
公告与补丁
|
目前厂商已经发布了升级补丁以修复这个安全问题，补丁下载链接： http://www.microsoft.com/technet/security/Bulletin/MS08-014.mspx?pf=true |
–
漏洞信息 (F64515)
| TPTI-08-03.txt (PacketStormID:F64515) |
2008-03-13 00:00:00 |
| Cody Pierce tippingpoint.com |
advisory,remote,arbitrary |
CVE-2008-0116 |
[点击下载] |
|
A vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Office Excel. Exploitation requires that the attacker coerce the target into opening a malicious .XLS file. The specific flaw exists within the parsing of the BIFF file format used by Microsoft Excel. During the processing of a malformed tag a heap allocation can be adversely controlled. When user supplied data is copied to a heap buffer the resulting data results in a arbitrary memory overwrite. If successfully exploited this could lead to system compromise under the credentials of the currently logged in user. |
TPTI-08-03: Microsoft Excel Rich Text Memory Corruption Vulnerability
http://dvlabs.tippingpoint.com/advisory/TPTI-08-03
March 11, 2008
-- CVE ID:
CVE-2008-0116
-- Affected Vendors:
Microsoft
-- Affected Products:
Microsoft Office Excel 2003
Microsoft Office Excel 2002
Microsoft Office Excel 2000
-- TippingPoint(TM) IPS Customer Protection:
TippingPoint IPS customers have been protected against this
vulnerability by Digital Vaccine protection filter ID 6000.
For further product information on the TippingPoint IPS, visit:
http://www.tippingpoint.com
-- Vulnerability Details:
This vulnerability allows remote attackers to execute arbitrary code on
vulnerable installations of Microsoft Office Excel. Exploitation
requires that the attacker coerce the target into opening a malicious
.XLS file.
The specific flaw exists within the parsing of the BIFF file format used
by Microsoft Excel. During the processing of a malformed tag a heap
allocation can be adversely controlled. When user supplied data is
copied to a heap buffer the resulting data results in a arbitrary memory
overwrite. If successfully exploited this could lead to system
compromise under the credentials of the currently logged in user.
-- Vendor Response:
Microsoft has issued an update to correct this vulnerability. More
details can be found at:
http://www.microsoft.com/technet/security/Bulletin/MS08-014.mspx
-- Disclosure Timeline:
2007-10-17 - Vulnerability reported to vendor
2008-03-11 - Coordinated public release of advisory
-- Credit:
This vulnerability was discovered by:
* Cody Pierce, TippingPoint DVLabs
–
漏洞信息
42730 |
|
| Microsoft Excel BIFF File Format Rich Text Tag Malformed Tag Memory Corruption | |
Local Access Required, Remote / Network Access, Context Dependent |
Input Manipulation |
| Loss of Integrity | Patch / RCS |
| Exploit Unknown | Vendor Verified |
–
漏洞描述
| A buffer overflow exists in Excel. The program fails to validate BIFF files resulting in a heap overflow. With a specially crafted file, a context-dependent attacker can cause arbitrary code execution resulting in a loss of integrity. |
–
时间线
2008-03-11 |
2007-10-17 |
| Unknow | 2008-03-11 |
–
解决方案
| Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released a patch to address this vulnerability. |
–
相关参考
|
–
漏洞作者
–
漏洞信息
| Microsoft Excel Rich Text Value Heap Buffer Overflow Vulnerability | |
Configuration Error |
28168 |
| Yes | No |
| 2008-03-10 12:00:00 | 2008-03-21 08:20:00 |
Cody Pierce of TippingPoint DVLabs is credited with the discovery of this vulnerability. |
|
–
受影响的程序版本
| Microsoft Office XP SP3
+ Microsoft Excel 2002 SP3
+ Microsoft Excel 2002 SP3
+ Microsoft FrontPage 2002 SP3
+ Microsoft FrontPage 2002 SP3
+ Microsoft Outlook 2002 SP3
+ Microsoft Outlook 2002 SP3
+ Microsoft PowerPoint 2002 SP3
+ Microsoft PowerPoint 2002 SP3
+ Microsoft Publisher 2002 SP3
+ Microsoft Publisher 2002 SP3 Microsoft Office XP SP2
– Microsoft Windows 2000 Professional SP3
– Microsoft Windows 2000 Professional SP2
– Microsoft Windows 2000 Professional SP1
– Microsoft Windows 2000 Professional
– Microsoft Windows 98
– Microsoft Windows 98SE
– Microsoft Windows ME
– Microsoft Windows NT Workstation 4.0 SP6a
– Microsoft Windows NT Workstation 4.0 SP6
– Microsoft Windows NT Workstation 4.0 SP5
– Microsoft Windows NT Workstation 4.0 SP4
– Microsoft Windows NT Workstation 4.0 SP3
– Microsoft Windows NT Workstation 4.0 SP2
– Microsoft Windows NT Workstation 4.0 SP1
– Microsoft Windows NT Workstation 4.0
– Microsoft Windows XP Home SP1
– Microsoft Windows XP Home
– Microsoft Windows XP Professional SP1
– Microsoft Windows XP Professional Microsoft Office XP SP1
– Microsoft Windows 2000 Professional SP2
– Microsoft Windows 2000 Professional SP1
– Microsoft Windows 2000 Professional
– Microsoft Windows 98
– Microsoft Windows ME
– Microsoft Windows NT Workstation 4.0 SP6a
– Microsoft Windows NT Workstation 4.0 SP6
– Microsoft Windows NT Workstation 4.0 SP5
– Microsoft Windows NT Workstation 4.0 SP4
– Microsoft Windows NT Workstation 4.0 SP3
– Microsoft Windows NT Workstation 4.0 SP2
– Microsoft Windows NT Workstation 4.0 SP1
– Microsoft Windows NT Workstation 4.0
– Microsoft Windows XP Home
– Microsoft Windows XP Professional Microsoft Office XP
– Microsoft Windows 2000 Professional SP2
– Microsoft Windows 2000 Professional SP1
– Microsoft Windows 2000 Professional
– Microsoft Windows 98
– Microsoft Windows ME
– Microsoft Windows NT Workstation 4.0 SP6a
– Microsoft Windows NT Workstation 4.0 SP6
– Microsoft Windows NT Workstation 4.0 SP5
– Microsoft Windows NT Workstation 4.0 SP4
– Microsoft Windows NT Workstation 4.0 SP3
– Microsoft Windows NT Workstation 4.0 SP2
– Microsoft Windows NT Workstation 4.0 SP1
– Microsoft Windows NT Workstation 4.0
– Microsoft Windows XP Home
– Microsoft Windows XP Professional Microsoft Office Compatibility Pack 2007 0 Microsoft Office 2008 for Mac 0 Microsoft Office 2004 for Mac 0 Microsoft Office 2003 SP3 Microsoft Office 2003 SP2 Microsoft Office 2003 SP1 Microsoft Office 2003 0
+ Microsoft Excel 2003
+ Microsoft FrontPage 2003
+ Microsoft InfoPath 2003
+ Microsoft OneNote 2003 0
+ Microsoft Outlook 2003 0
+ Microsoft PowerPoint 2003 0
+ Microsoft Publisher 2003 Microsoft Office 2000 SP3
– Microsoft Windows 2000 Professional SP3
– Microsoft Windows 2000 Professional SP2
– Microsoft Windows 2000 Professional SP1
– Microsoft Windows 2000 Professional
– Microsoft Windows 98
– Microsoft Windows 98SE
– Microsoft Windows ME
– Microsoft Windows NT Workstation 4.0 SP6a
– Microsoft Windows NT Workstation 4.0 SP6
– Microsoft Windows NT Workstation 4.0 SP5
– Microsoft Windows NT Workstation 4.0 SP4
– Microsoft Windows NT Workstation 4.0 SP3
– Microsoft Windows NT Workstation 4.0 SP2
– Microsoft Windows NT Workstation 4.0 SP1
– Microsoft Windows NT Workstation 4.0
– Microsoft Windows XP Home SP1
– Microsoft Windows XP Home
– Microsoft Windows XP Professional SP1
– Microsoft Windows XP Professional Microsoft Office 2000 SP1
– Microsoft Windows 2000 Professional SP2
– Microsoft Windows 2000 Professional SP1
– Microsoft Windows 2000 Professional
– Microsoft Windows ME
– Microsoft Windows NT Workstation 4.0 SP6a
– Microsoft Windows NT Workstation 4.0 SP6
– Microsoft Windows NT Workstation 4.0 SP5
– Microsoft Windows NT Workstation 4.0 SP4
– Microsoft Windows NT Workstation 4.0 SP3
– Microsoft Windows NT Workstation 4.0 SP2
– Microsoft Windows NT Workstation 4.0 SP1
– Microsoft Windows NT Workstation 4.0
– Microsoft Windows XP Home
– Microsoft Windows XP Professional Microsoft Office 2000
– Microsoft Windows 2000 Professional SP2
– Microsoft Windows 2000 Professional SP1
– Microsoft Windows 2000 Professional
– Microsoft Windows 95
– Microsoft Windows 98
– Microsoft Windows ME
– Microsoft Windows NT Workstation 4.0 SP6a
– Microsoft Windows NT Workstation 4.0 SP6
– Microsoft Windows NT Workstation 4.0 SP5
– Microsoft Windows NT Workstation 4.0 SP4
– Microsoft Windows NT Workstation 4.0 SP3
– Microsoft Windows NT Workstation 4.0 SP2
– Microsoft Windows NT Workstation 4.0 SP1
– Microsoft Windows NT Workstation 4.0
– Microsoft Windows XP Home
– Microsoft Windows XP Professional Microsoft Internet Explorer for Unix SP2 Microsoft Excel Viewer 2003 0
+ Microsoft Office 2003 SP1
+ Microsoft Office 2003 SP1
+ Microsoft Office 2003 SP1 Microsoft Excel 2008 for Mac 0 Microsoft Excel 2004 for Mac 0 Microsoft Excel 2003 SP3 Microsoft Excel 2003 SP2 Microsoft Excel 2003 SP1
+ Microsoft Office 2003 SP1 Microsoft Excel 2003
+ Microsoft Office 2003 0 Microsoft Excel 2002 SP3
+ Microsoft Office XP SP3 Microsoft Excel 2002 SP2
+ Microsoft Office XP SP2
– Microsoft Windows 2000 Professional SP3
– Microsoft Windows 2000 Professional SP2
– Microsoft Windows 2000 Professional SP1
– Microsoft Windows 2000 Professional
– Microsoft Windows 98
– Microsoft Windows 98SE
– Microsoft Windows ME
– Microsoft Windows NT Workstation 4.0 SP6a
– Microsoft Windows NT Workstation 4.0 SP6
– Microsoft Windows NT Workstation 4.0 SP5
– Microsoft Windows NT Workstation 4.0 SP4
– Microsoft Windows NT Workstation 4.0 SP3
– Microsoft Windows NT Workstation 4.0 SP2
– Microsoft Windows NT Workstation 4.0 SP1
– Microsoft Windows NT Workstation 4.0
– Microsoft Windows XP Home SP1
– Microsoft Windows XP Home
– Microsoft Windows XP Professional SP1
– Microsoft Windows XP Professional Microsoft Excel 2002 SP1
+ Microsoft Office XP SP1
– Microsoft Windows 2000 Advanced Server SP2
– Microsoft Windows 2000 Advanced Server SP1
– Microsoft Windows 2000 Advanced Server
– Microsoft Windows 2000 Datacenter Server SP2
– Microsoft Windows 2000 Datacenter Server SP1
– Microsoft Windows 2000 Datacenter Server
– Microsoft Windows 2000 Professional SP2
– Microsoft Windows 2000 Professional SP1
– Microsoft Windows 2000 Professional
– Microsoft Windows 2000 Server SP2
– Microsoft Windows 2000 Server SP1
– Microsoft Windows 2000 Server
– Microsoft Windows 2000 Terminal Services SP2
– Microsoft Windows 2000 Terminal Services SP1
– Microsoft Windows 2000 Terminal Services
– Microsoft Windows 98
– Microsoft Windows 98SE
– Microsoft Windows ME
– Microsoft Windows NT Enterprise Server 4.0 SP6a
– Microsoft Windows NT Enterprise Server 4.0 SP6
– Microsoft Windows NT Enterprise Server 4.0 SP5
– Microsoft Windows NT Enterprise Server 4.0 SP4
– Microsoft Windows NT Enterprise Server 4.0 SP3
– Microsoft Windows NT Enterprise Server 4.0 SP2
– Microsoft Windows NT Enterprise Server 4.0 SP1
– Microsoft Windows NT Enterprise Server 4.0
– Microsoft Windows NT Server 4.0 SP6a
– Microsoft Windows NT Server 4.0 SP6
– Microsoft Windows NT Server 4.0 SP5
– Microsoft Windows NT Server 4.0 SP4
– Microsoft Windows NT Server 4.0 SP3
– Microsoft Windows NT Server 4.0 SP2
– Microsoft Windows NT Server 4.0 SP1
– Microsoft Windows NT Server 4.0
– Microsoft Windows NT Terminal Server 4.0 SP6
– Microsoft Windows NT Terminal Server 4.0 SP5
– Microsoft Windows NT Terminal Server 4.0 SP4
– Microsoft Windows NT Terminal Server 4.0 SP3
– Microsoft Windows NT Terminal Server 4.0 SP2
– Microsoft Windows NT Terminal Server 4.0 SP1
– Microsoft Windows NT Terminal Server 4.0
– Microsoft Windows NT Workstation 4.0 SP6a
– Microsoft Windows NT Workstation 4.0 SP6
– Microsoft Windows NT Workstation 4.0 SP5
– Microsoft Windows NT Workstation 4.0 SP4
– Microsoft Windows NT Workstation 4.0 SP3
– Microsoft Windows NT Workstation 4.0 SP2
– Microsoft Windows NT Workstation 4.0 SP1
– Microsoft Windows NT Workstation 4.0
– Microsoft Windows XP Home
– Microsoft Windows XP Professional Microsoft Excel 2002
+ Microsoft Office XP
– Microsoft Windows 2000 Professional SP2
– Microsoft Windows 2000 Professional SP1
– Microsoft Windows 2000 Professional
– Microsoft Windows 95 SR2
– Microsoft Windows 95
– Microsoft Windows 98
– Microsoft Windows 98SE
– Microsoft Windows ME
– Microsoft Windows NT 4.0 SP6a
– Microsoft Windows NT 4.0 SP5
– Microsoft Windows NT 4.0 SP4
– Microsoft Windows NT 4.0 SP3
– Microsoft Windows NT 4.0 SP2
– Microsoft Windows NT 4.0 SP1
– Microsoft Windows NT 4.0 Microsoft Excel 2000 SR1
+ Microsoft Office 2000 SP1
– Microsoft Windows 2000 Advanced Server SP2
– Microsoft Windows 2000 Advanced Server SP1
– Microsoft Windows 2000 Advanced Server
– Microsoft Windows 2000 Datacenter Server SP2
– Microsoft Windows 2000 Datacenter Server SP1
– Microsoft Windows 2000 Datacenter Server
– Microsoft Windows 2000 Professional SP2
– Microsoft Windows 2000 Professional SP1
– Microsoft Windows 2000 Professional
– Microsoft Windows 2000 Server SP2
– Microsoft Windows 2000 Server SP1
– Microsoft Windows 2000 Server
– Microsoft Windows 2000 Terminal Services SP2
– Microsoft Windows 2000 Terminal Services SP1
– Microsoft Windows 2000 Terminal Services
– Microsoft Windows 95
– Microsoft Windows 98
– Microsoft Windows 98SE
– Microsoft Windows ME
– Microsoft Windows NT Enterprise Server 4.0 SP6a
– Microsoft Windows NT Enterprise Server 4.0 SP6
– Microsoft Windows NT Enterprise Server 4.0 SP5
– Microsoft Windows NT Enterprise Server 4.0 SP4
– Microsoft Windows NT Enterprise Server 4.0 SP3
– Microsoft Windows NT Enterprise Server 4.0 SP2
– Microsoft Windows NT Enterprise Server 4.0 SP1
– Microsoft Windows NT Enterprise Server 4.0
– Microsoft Windows NT Server 4.0 SP6a
– Microsoft Windows NT Server 4.0 SP6
– Microsoft Windows NT Server 4.0 SP5
– Microsoft Windows NT Server 4.0 SP4
– Microsoft Windows NT Server 4.0 SP3
– Microsoft Windows NT Server 4.0 SP2
– Microsoft Windows NT Server 4.0 SP1
– Microsoft Windows NT Server 4.0
– Microsoft Windows NT Terminal Server 4.0 SP6
– Microsoft Windows NT Terminal Server 4.0 SP5
– Microsoft Windows NT Terminal Server 4.0 SP4
– Microsoft Windows NT Terminal Server 4.0 SP3
– Microsoft Windows NT Terminal Server 4.0 SP2
– Microsoft Windows NT Terminal Server 4.0 SP1
– Microsoft Windows NT Terminal Server 4.0
– Microsoft Windows NT Workstation 4.0 SP6a
– Microsoft Windows NT Workstation 4.0 SP6
– Microsoft Windows NT Workstation 4.0 SP5
– Microsoft Windows NT Workstation 4.0 SP4
– Microsoft Windows NT Workstation 4.0 SP3
– Microsoft Windows NT Workstation 4.0 SP2
– Microsoft Windows NT Workstation 4.0 SP1
– Microsoft Windows NT Workstation 4.0 Microsoft Excel 2000 SP3
+ Microsoft Office 2000 SP3
– Microsoft Windows 2000 Professional SP3
– Microsoft Windows 2000 Professional SP2
– Microsoft Windows 2000 Professional SP1
– Microsoft Windows 2000 Professional
– Microsoft Windows 98
– Microsoft Windows 98SE
– Microsoft Windows ME
– Microsoft Windows NT Workstation 4.0 SP6a
– Microsoft Windows NT Workstation 4.0 SP6
– Microsoft Windows NT Workstation 4.0 SP5
– Microsoft Windows NT Workstation 4.0 SP4
– Microsoft Windows NT Workstation 4.0 SP3
– Microsoft Windows NT Workstation 4.0 SP2
– Microsoft Windows NT Workstation 4.0 SP1
– Microsoft Windows NT Workstation 4.0
– Microsoft Windows XP Home SP1
– Microsoft Windows XP Home
– Microsoft Windows XP Professional SP1
– Microsoft Windows XP Professional Microsoft Excel 2000 SP2
+ Microsoft Office 2000 SP2
– Microsoft Windows 2000 Advanced Server SP2
– Microsoft Windows 2000 Advanced Server SP1
– Microsoft Windows 2000 Advanced Server
– Microsoft Windows 2000 Datacenter Server SP2
– Microsoft Windows 2000 Datacenter Server SP1
– Microsoft Windows 2000 Datacenter Server
– Microsoft Windows 2000 Professional SP2
– Microsoft Windows 2000 Professional SP1
– Microsoft Windows 2000 Professional
– Microsoft Windows 2000 Server SP2
– Microsoft Windows 2000 Server SP1
– Microsoft Windows 2000 Server
– Microsoft Windows 2000 Terminal Services SP2
– Microsoft Windows 2000 Terminal Services SP1
– Microsoft Windows 2000 Terminal Services
– Microsoft Windows 95
– Microsoft Windows 98
– Microsoft Windows 98SE
– Microsoft Windows ME
– Microsoft Windows NT Enterprise Server 4.0 SP6a
– Microsoft Windows NT Enterprise Server 4.0 SP6
– Microsoft Windows NT Enterprise Server 4.0 SP5
– Microsoft Windows NT Enterprise Server 4.0 SP4
– Microsoft Windows NT Enterprise Server 4.0 SP3
– Microsoft Windows NT Enterprise Server 4.0 SP2
– Microsoft Windows NT Enterprise Server 4.0 SP1
– Microsoft Windows NT Enterprise Server 4.0
– Microsoft Windows NT Server 4.0 SP6a
– Microsoft Windows NT Server 4.0 SP6
– Microsoft Windows NT Server 4.0 SP5
– Microsoft Windows NT Server 4.0 SP4
– Microsoft Windows NT Server 4.0 SP3
– Microsoft Windows NT Server 4.0 SP2
– Microsoft Windows NT Server 4.0 SP1
– Microsoft Windows NT Server 4.0
– Microsoft Windows NT Terminal Server 4.0 SP6
– Microsoft Windows NT Terminal Server 4.0 SP5
– Microsoft Windows NT Terminal Server 4.0 SP4
– Microsoft Windows NT Terminal Server 4.0 SP3
– Microsoft Windows NT Terminal Server 4.0 SP2
– Microsoft Windows NT Terminal Server 4.0 SP1
– Microsoft Windows NT Terminal Server 4.0
– Microsoft Windows NT Workstation 4.0 SP6a
– Microsoft Windows NT Workstation 4.0 SP6
– Microsoft Windows NT Workstation 4.0 SP5
– Microsoft Windows NT Workstation 4.0 SP4
– Microsoft Windows NT Workstation 4.0 SP3
– Microsoft Windows NT Workstation 4.0 SP2
– Microsoft Windows NT Workstation 4.0 SP1
– Microsoft Windows NT Workstation 4.0 Microsoft Excel 2000 0 |
–
漏洞讨论
| Microsoft Excel is prone to a heap-based buffer-overflow vulnerability. This issue occurs because the application fails to perform adequate boundary-checks on user-supplied data. Attackers may exploit this issue by enticing victims into opening a maliciously crafted Excel file ('.xls'). Successful exploits may allow attackers to execute arbitrary code with the privileges of the user running the application. This may facilitate a compromise of vulnerable computers. |
–
漏洞利用
|
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
|
–
解决方案
|
Microsoft released fixes and an advisory to address this issue. Please see the references for more information. NOTE: On March 13, 2008, Microsoft updated security bulletin MS08-014. The vendor reported that some users may experience problems caused by this update. An issue in this update may lead to incorrect results from Excel calculations where a Real Time Data source is used in a user-defined Visual Basic for Applications function. Customers using Microsoft Excel 2003 Service Pack 2 or Service Pack 3 with a Real Time Data source for a user-defined Visual Basic for Applications function are advised to test additions before deploying this update. The vendor recommends considering the workarounds in security bulletin MS08-014 if this update cannot be deployed because of this issue.
|
–
相关参考
|
![[猎奇] 北极熊袭击美国核潜艇误以为是大鱼抱着啃半天-微慑信息网-VulSee.com](http://cimg.163.com/news/0407/30/d60.jpg)
![[八卦] 王婷婷—揭秘一个大三女生的性爱录像-微慑信息网-VulSee.com](http://free.86hy.com/crack/pic/1.jpg)
![[随笔]今天国际警察节-微慑信息网-VulSee.com](http://photo.sohu.com/20041017/Img222528326.jpg)
青云网
