CVE-2008-4264

{"id": "CVE-2008-4264", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": true, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2008-12-10T14:00:01.080", "references": [{"url": "http://www.securityfocus.com/bid/32621", "source": "secure@microsoft.com"}, {"url": "http://www.securitytracker.com/id?1021368", "source": "secure@microsoft.com"}, {"url": "http://www.us-cert.gov/cas/techalerts/TA08-344A.html", "tags": ["US Government Resource"], "source": "secure@microsoft.com"}, {"url": "http://www.vupen.com/english/advisories/2008/3386", "source": "secure@microsoft.com"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-074", "source": "secure@microsoft.com"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5556", "source": "secure@microsoft.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-399"}]}], "descriptions": [{"lang": "en", "value": "Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via a crafted Excel spreadsheet that contains a malformed formula, which triggers \"pointer corruption\" during the loading of formulas from this spreadsheet, aka \"File Format Parsing Vulnerability.\""}, {"lang": "es", "value": "Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, y 2007 Gold y SP1; Excel Viewer 2003 Gold y SP3; Excel Viewer; Office Compatibility Pack para Word, Excel, y PowerPoint 2007 File Formats Gold y SP1; Office 2004 y 2008 para Mac; y Open XML File Format Converter para Mac que permite a los atacantes remotos ejecutar arbitrariamente c\u00f3digo a trav\u00e9s de hojas de Excel manipulada que pueden contener f\u00f3rmular malformadas, las cuales lanzan una \"corrupci\u00f3n de puntero\" durante la carga de f\u00f3rmulas desde esta hoja, alias \"Vulnerabilidad de analizador de formato de archivo\""}], "lastModified": "2018-10-12T21:48:52.517", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:office_excel:2000:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "806086B6-AB83-4008-A1A2-73BC35A95925"}, {"criteria": "cpe:2.3:a:microsoft:office_excel:2002:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ECDF1C1D-EF63-4A3E-AEE2-2D2D9FDBF368"}, {"criteria": "cpe:2.3:a:microsoft:office_excel:2003:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AD22DBA8-40B0-4197-9D56-38D5D9E1ED89"}, {"criteria": "cpe:2.3:a:microsoft:office_excel:2007:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "3BCABD31-F406-4184-97AF-21AD95353D26"}, {"criteria": "cpe:2.3:a:microsoft:office_excel:2007:sp1:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "297A9F48-13DF-4042-AC21-B8B764B217BE"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:20007_office_system:*:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B507F860-5D28-4E86-8F61-FC71F4C030C3"}, {"criteria": "cpe:2.3:a:microsoft:20007_office_system:sp1:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F9A0B1B7-21A7-4038-8738-02AFADAAB06D"}, {"criteria": "cpe:2.3:a:microsoft:office:2000:sp3:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4891122F-AD7F-45E6-98C6-833227916F6B"}, {"criteria": "cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A332D04D-CC8C-4F68-A261-BA2F2D8EAD1E"}, {"criteria": "cpe:2.3:a:microsoft:office:xp:sp3:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "79BA1175-7F02-4435-AEA6-1BA8AADEB7EF"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:office:2004:*:mac:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9409A9BD-1E9B-49B8-884F-8FE569D8AA25"}, {"criteria": "cpe:2.3:a:microsoft:office:2008:*:mac:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5BA91840-371C-4282-9F7F-B393F785D260"}, {"criteria": "cpe:2.3:a:microsoft:office_compatibility_pack_for_word_excel_ppt_2007:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CD97FF64-64A5-467C-B352-45B89B4A6536"}, {"criteria": "cpe:2.3:a:microsoft:office_compatibility_pack_for_word_excel_ppt_2007:*:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "34C5FEAD-4B4B-44EB-9F3A-05093347A2F1"}, {"criteria": "cpe:2.3:a:microsoft:office_excel_viewer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4A2613CE-C469-43AE-A590-87CE1FAADA8B"}, {"criteria": "cpe:2.3:a:microsoft:office_excel_viewer:2003:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0BB3D66F-9028-4703-9D6A-629331EEB492"}, {"criteria": "cpe:2.3:a:microsoft:office_excel_viewer:2003:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B18C291F-57C2-4328-8FCF-3C1A27B0D18D"}, {"criteria": "cpe:2.3:a:microsoft:open_xml_file_format_converter:*:*:mac:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3807A4E4-EB58-47B6-AD98-6ED464DEBA4E"}], "operator": "OR"}]}], "evaluatorComment": "http://www.microsoft.com/technet/security/Bulletin/MS08-074.mspx\r\n\r\n\t\r\nFile Format Parsing Vulnerability - CVE-2008-4264\r\n\r\nA remote code execution vulnerability exists in Microsoft Office Excel as a result of pointer corruption when loading Excel formulas. The vulnerability could allow remote code execution if a user opens a specially crafted Excel file that includes a malformed formula. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.", "sourceIdentifier": "secure@microsoft.com"}