Vulnerability Note VU#692417

Microsoft Word code execution vulnerability

Overview

Microsoft Word contains a vulnerability that may allow an attacker to execute arbitrary code.

I. Description

Per Microsoft Security Bulletin MS08-009:

A remote code execution vulnerability exists in the way that Word handles specially crafted Word files. The vulnerability could allow remote code execution if a user opens a specially crafted Word file that includes a malformed value. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

II. Impact

A remote attacker may be able to execute arbitrary code.

III. Solution

Microsoft has released Security Bulletin MS08-009 to address this issue.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Microsoft Corporation	Vulnerable	12-Feb-2008

References

http://www.microsoft.com/technet/security/bulletin/ms08-009.mspx

Credit

Microsoft credits Rub�n Santamarta of Reversemode.com for reporting this vulnerability.

This document was written by Ryan Giobbi.

Other Information

Date Public:	2008-02-12
Date First Published:	2008-02-12
Date Last Updated:	2008-02-12
CERT Advisory:
CVE-ID(s):	CVE-2008-0109
NVD-ID(s):	CVE-2008-0109
US-CERT Technical Alerts:
Metric:	22.34
Document Revision:	6

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Produced 2008 by US-CERT, a government organization
Disclaimers and copyright information

Get Adobe Reader