Microsoft Project Resource Memory Allocation Remote Code Execution Vulnerability

Bugtraq ID:	28607
Class:	Design Error
CVE:	CVE-2008-1088
Remote:	Yes
Local:	No
Published:	Apr 08 2008 12:00AM
Updated:	Apr 16 2008 12:28AM
Credit:	National Cyber Security Center, The Republic of Korea
Vulnerable:	Microsoft Project 2003 SP2 Microsoft Project 2003 Microsoft Project 2002 SP1 Microsoft Project 2002 0 Microsoft Project 2000 SR1 Microsoft Project 2000 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0
Not Vulnerable:

Microsoft Project Resource Memory Allocation Remote Code Execution Vulnerability

Microsoft Project is prone to a remote code-execution vulnerability.

An attacker may exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions.

Microsoft Project Resource Memory Allocation Remote Code Execution Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft Project Resource Memory Allocation Remote Code Execution Vulnerability

Solution:
The vendor has released updates. Please see the references for more information.


Microsoft Project 2000 SR1

• Microsoft Security Update for Microsoft Project 2000 (KB949043)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=fbe46241-b9da -40c6-803d-42eb6234be77&displaylang=en

Microsoft Project 2003 SP2

• Microsoft Security Update for Microsoft Office Project 2003 (KB948962)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=aaba07d6-e972 -4e85-bccd-406aa2c4a4f4

Microsoft Project Resource Memory Allocation Remote Code Execution Vulnerability

References:

• Microsoft Project Homepage (Microsoft)
  
• Vulnerability Note VU#155563 (US-CERT)
  
• Microsoft Security Bulletin MS08-018 (Microsoft)