BID:32579

Microsoft Word RTF Polyline/Polygon Integer Overflow Vulnerability

Info

Microsoft Word RTF Polyline/Polygon Integer Overflow Vulnerability

Bugtraq ID:	32579
Class:	Boundary Condition Error
CVE:	CVE-2008-4025
Remote:	Yes
Local:	No
Published:	Dec 09 2008 12:00AM
Updated:	Jan 13 2009 07:22PM
Credit:	Dyon Balding of Secunia Research
Vulnerable:	Microsoft Word 2007 SP1 Microsoft Word 2007 0 Microsoft Word 2003 SP3 Microsoft Word 2003 SP2 + Microsoft Office 2003 SP1 + Microsoft Office 2003 SP1 + Microsoft Office 2003 0 + Microsoft Office 2003 0 Microsoft Word 2003 SP1 + Microsoft Office 2003 SP1 + Microsoft Office 2003 SP1 + Microsoft Office 2003 0 + Microsoft Office 2003 0 Microsoft Word 2003 + Microsoft Office 2003 SP1 + Microsoft Office 2003 0 Microsoft Word 2002 SP3 Microsoft Word 2002 SP2 + Microsoft Office XP SP2 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Microsoft Word 2002 SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 alpha - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Microsoft Word 2002 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 alpha - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Microsoft Word 2000 SR1 + Microsoft Office 2000 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Microsoft Word 2000 SP3 + Microsoft Office 2000 SP3 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Microsoft Word 2000 SP2 + Microsoft Office 2000 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Microsoft Word 2000 + Microsoft Office 2000 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Microsoft Outlook 2007 SP1 0 Microsoft Outlook 2007 0 Microsoft Open XML File Format Converter for Mac 0 Microsoft Office Word Viewer 0 Microsoft Office Word 2003 Viewer SP3 Microsoft Office Compatibility Pack 2007 SP1 Microsoft Office Compatibility Pack 2007 0 Microsoft Office 2008 for Mac 0 Microsoft Office 2004 for Mac 0 Microsoft Office 2003 SP3 Microsoft Office 2003 SP2 Microsoft Office 2003 SP1 Microsoft Office 2003 0 + Microsoft Excel 2003 + Microsoft FrontPage 2003 + Microsoft InfoPath 2003 + Microsoft OneNote 2003 0 + Microsoft Outlook 2003 0 + Microsoft PowerPoint 2003 0 + Microsoft Publisher 2003 Microsoft Office 2000 SP3 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Microsoft Office 2000 SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Microsoft Office 2000 SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional

Not Vulnerable:

Discussion

Microsoft Word RTF Polyline/Polygon Integer Overflow Vulnerability

Microsoft Word is prone to an integer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

An attacker could exploit this issue by enticing a victim to open a malicious RTF file.

Successfully exploiting this issue would allow the attacker to execute arbitrary code in the context of the currently logged-in user.

Exploit / POC

Microsoft Word RTF Polyline/Polygon Integer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Solution / Fix

Microsoft Word RTF Polyline/Polygon Integer Overflow Vulnerability

Solution:
The vendor released an advisory and updates to address this issue. Please see the references for more information.

Microsoft Office 2008 for Mac 0

Microsoft Microsoft Office 2008 for Mac 12.1.5 Update
http://www.microsoft.com/downloads/details.aspx?FamilyId=AB31A564-43D2 -45BD-98BF-19E9CA477B62

Microsoft Office Word 2003 Viewer SP3

Microsoft Security Update for Microsoft Office Word Viewer 2003 (KB956366)
http://www.microsoft.com/downloads/details.aspx?FamilyId=70de7c3c-519f -4f4a-a03f-027f80b5415c

Microsoft Office Compatibility Pack 2007 SP1

Microsoft Security Update for 2007 Microsoft Office System (KB956828)
http://www.microsoft.com/downloads/details.aspx?FamilyId=55430121-4476 -48b8-9f6f-4a60fa0b2970

Microsoft Word 2003 SP3

Microsoft Security Update for Microsoft Office Word 2003 (KB956357)
http://www.microsoft.com/downloads/details.aspx?FamilyId=45c81c60-4b1b -4246-839b-198ebc4eeae2

Microsoft Open XML File Format Converter for Mac 0

Microsoft Open XML File Format Converter for Mac 1.0.2
http://www.microsoft.com/downloads/details.aspx?FamilyId=EDB6CD8F-832C -4123-8982-AC0C601EA0A7

Microsoft Outlook 2007 SP1 0

Microsoft Security Update for Microsoft Office Word 2007 (KB956358)
http://www.microsoft.com/downloads/details.aspx?FamilyId=5b51cb5e-3899 -4257-82cf-7e92fa619c37

Microsoft Office 2004 for Mac 0

Microsoft Microsoft Office 2004 for Mac 11.5.3 Update
http://www.microsoft.com/downloads/details.aspx?FamilyId=ECA13AD8-62AE -41A8-B308-41E2D1773820

Microsoft Office Compatibility Pack 2007 0

Microsoft Security Update for 2007 Microsoft Office System (KB956828)
http://www.microsoft.com/downloads/details.aspx?FamilyId=55430121-4476 -48b8-9f6f-4a60fa0b2970

Microsoft Word 2000 SP3

Microsoft Security Update for Microsoft Word 2000 (KB956328)
http://www.microsoft.com/downloads/details.aspx?FamilyId=43e8c4d8-307b -48f6-ac99-a9617421d40a

Microsoft Word 2002 SP3

Microsoft Security Update for Microsoft Word 2002 (KB956329)
http://www.microsoft.com/downloads/details.aspx?FamilyId=3ef41412-50b3 -4077-b0e3-9a3704d2f876

Microsoft Word 2007 SP1

Microsoft Security Update for Microsoft Office Word 2007 (KB956358)
http://www.microsoft.com/downloads/details.aspx?FamilyId=5b51cb5e-3899 -4257-82cf-7e92fa619c37

Microsoft Outlook 2007 0

Microsoft Security Update for Microsoft Office Word 2007 (KB956358)
http://www.microsoft.com/downloads/details.aspx?FamilyId=5b51cb5e-3899 -4257-82cf-7e92fa619c37

References

Microsoft Word RTF Polyline/Polygon Integer Overflow Vulnerability

References:

Microsoft Word Homepage (Microsoft )
Microsoft Word RTF Polyline/Polygon Integer Overflow (Secunia Research)
Secunia Research: Microsoft Word RTF Polyline/Polygon Integer Overflow (Secunia Research )
Microsoft Security Bulletin MS08-072 (Microsoft)