English

Calendar Discussions Polls

RSS feeds Subscriptions Contacts

The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service.

Internet threat level: 1

Read us on

Home→Descriptions→SA30285

Microsoft Office Word Multiple Vulnerabilities

Secunia ID	SA30285
CVE-ID	CVE-2008-4024, CVE-2008-4025, CVE-2008-4026, CVE-2008-4027, CVE-2008-4028, CVE-2008-4030, CVE-2008-4031, CVE-2008-4837
Release Date	09 Dec 2008
Last Change	14 Jan 2009
Criticality	Highly Critical
Solution Status	Vendor Patch
Software	Microsoft Office 2000 Microsoft Office 2003 Professional Edition Microsoft Office 2003 Small Business Edition Microsoft Office 2003 Standard Edition Microsoft Office 2003 Student and Teacher Edition Microsoft Office 2004 for Mac Microsoft Office 2007 Microsoft Office 2008 for Mac Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Microsoft Office Word 2007 Microsoft Office Word Viewer Microsoft Office Word Viewer 2003 Microsoft Office XP Microsoft Open XML File Format Converter for Mac Microsoft Outlook 2007 Microsoft Word 2000 Microsoft Word 2002 Microsoft Word 2003 Microsoft Works 8.x
Where	From remote
Impact	System access This covers vulnerabilities where malicious people are able to gain system access and execute arbitrary code with the privileges of a local user.
Description	Multiple vulnerabilities have been reported in Microsoft Office Word, which can be exploited by malicious people to compromise a user's system. 1) An error when processing List File Override (LFO) entries can be exploited to corrupt memory via a specially crafted Word file. 2) An integer overflow error exists when calculating the space required for the specified number of points in a polyline or polygon. This can be exploited to cause a heap-based buffer overflow during parsing of objects in Rich Text Format (.rtf) files e.g. when a user opens a specially crafted .rtf file with Word or previews a specially crafted e-mail. 3) An unspecified error when parsing certain records can be exploited to corrupt memory via a specially crafted Word file. 4) An error exists when processing consecutive "\do" drawing object tags encountered in RTF documents. This can be exploited to free a heap buffer twice and corrupt memory. 5) An error when processing mismatched "\dpgroup" and "\dpendgroup" controlwords can be exploited to cause a buffer overflow via an RTF document containing an overly large number of "\dpendgroup" tags. 6) A boundary error when parsing RTF documents containing multiple drawing object tags can be exploited to cause a heap-based buffer overflow. 7) A boundary error when processing RTF documents can be exploited to overflow a static buffer via a document containing an overly large number of "\stylesheet" control words. 8) An error when processing a malformed table property can be exploited to cause a stack-based buffer overflow via a specially crafted Word document. Successful exploitation of the vulnerabilities may allow execution of arbitrary code.
Solution	Apply patches. Microsoft Office Word 2000 SP3: http://www.microsoft.com/downloads/details.aspx?FamilyId=43e8c4d8-307b-48f6-ac99-a9617421d40a Microsoft Office Word 2002 SP3: http://www.microsoft.com/downloads/details.aspx?FamilyId=3ef41412-50b3-4077-b0e3-9a3704d2f876 Microsoft Office Word 2003 SP3: http://www.microsoft.com/downloads/details.aspx?FamilyId=45c81c60-4b1b-4246-839b-198ebc4eeae2 Microsoft Office Word 2007: http://www.microsoft.com/downloads/details.aspx?FamilyId=5b51cb5e-3899-4257-82cf-7e92fa619c37 Microsoft Office Outlook 2007: http://www.microsoft.com/downloads/details.aspx?FamilyId=5b51cb5e-3899-4257-82cf-7e92fa619c37 Microsoft Office Word 2007 SP1: http://www.microsoft.com/downloads/details.aspx?FamilyId=5b51cb5e-3899-4257-82cf-7e92fa619c37 Microsoft Office Outlook 2007 SP1: http://www.microsoft.com/downloads/details.aspx?FamilyId=5b51cb5e-3899-4257-82cf-7e92fa619c37 Microsoft Office Word Viewer 2003: http://www.microsoft.com/downloads/details.aspx?FamilyId=70de7c3c-519f-4f4a-a03f-027f80b5415c Microsoft Office Word Viewer 2003 SP3: http://www.microsoft.com/downloads/details.aspx?FamilyId=70de7c3c-519f-4f4a-a03f-027f80b5415c Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats: http://www.microsoft.com/downloads/details.aspx?FamilyId=55430121-4476-48b8-9f6f-4a60fa0b2970 Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1: http://www.microsoft.com/downloads/details.aspx?FamilyId=55430121-4476-48b8-9f6f-4a60fa0b2970 Microsoft Works 8 (requires update to Works 8.5): http://www.microsoft.com/downloads/details.aspx?familyid=1537d181-90d9-4bb5-b5ae-8d9990a349af Microsoft Office 2004 for Mac: http://www.microsoft.com/downloads/details.aspx?FamilyId=ECA13AD8-62AE-41A8-B308-41E2D1773820 Microsoft Office 2008 for Mac: http://www.microsoft.com/downloads/details.aspx?FamilyId=AB31A564-43D2-45BD-98BF-19E9CA477B62 Open XML File Format Converter for Mac: http://www.microsoft.com/downloads/details.aspx?FamilyId=EDB6CD8F-832C-4123-8982-AC0C601EA0A7 Microsoft Office Word Viewer: http://www.microsoft.com/downloads/details.aspx?FamilyId=70de7c3c-519f-4f4a-a03f-027f80b5415c
Reported by	1) The vendor credits Ricardo Narvaja, Core Security Technologies. 2) Dyon Balding, Secunia Research. 3) The vendor credits Yamata Li, Palo Alto Networks. 4) The vendor credits Wushi via ZDI. 5) The vendor credits Aaron Portnoy, TippingPoint DVLabs. 6) The vendor credits Wushi of team509 via ZDI. 7) The vendor credits Aaron Portnoy, TippingPoint DVLabs. 8) The vendor credits Wushi and Ling via ZDI.
Original Advisory	MS08-072 (KB957173): http://www.microsoft.com/technet/security/Bulletin/MS08-072.mspx Secunia Research: http://secunia.com/secunia_research/2008-21/ ZDI: http://www.zerodayinitiative.com/advisories/ZDI-08-084/ http://www.zerodayinitiative.com/advisories/ZDI-08-085/ http://www.zerodayinitiative.com/advisories/ZDI-08-086/ TippingPoint DVLabs: http://dvlabs.tippingpoint.com/advisory/TPTI-08-08 http://dvlabs.tippingpoint.com/advisory/TPTI-08-09 Core Security Technologies: http://www.coresecurity.com/content/word-arbitrary-free