BID:32581

Microsoft Word RTF '\do' Drawing Object Remote Heap Memory Corruption Vulnerability

Info

Microsoft Word RTF '\do' Drawing Object Remote Heap Memory Corruption Vulnerability

Bugtraq ID:	32581
Class:	Boundary Condition Error
CVE:	CVE-2008-4027
Remote:	Yes
Local:	No
Published:	Dec 09 2008 12:00AM
Updated:	Jan 13 2009 07:32PM
Credit:	Wushi of team509
Vulnerable:	Microsoft Word Viewer 2003 SP3 Microsoft Word 2007 SP1 Microsoft Word 2007 0 Microsoft Word 2003 SP3 Microsoft Word 2003 SP2 + Microsoft Office 2003 SP1 + Microsoft Office 2003 SP1 + Microsoft Office 2003 0 + Microsoft Office 2003 0 Microsoft Word 2003 SP1 + Microsoft Office 2003 SP1 + Microsoft Office 2003 SP1 + Microsoft Office 2003 0 + Microsoft Office 2003 0 Microsoft Word 2003 + Microsoft Office 2003 SP1 + Microsoft Office 2003 0 Microsoft Word 2002 SP3 Microsoft Word 2002 SP2 + Microsoft Office XP SP2 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Microsoft Word 2002 SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 alpha - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Microsoft Word 2002 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 alpha - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Microsoft Word 2000 SR1 + Microsoft Office 2000 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Microsoft Word 2000 SP3 + Microsoft Office 2000 SP3 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Microsoft Word 2000 SP2 + Microsoft Office 2000 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Microsoft Word 2000 + Microsoft Office 2000 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Microsoft Outlook 2007 SP1 0 Microsoft Outlook 2007 0 Microsoft Office Word 2003 Viewer SP3 Microsoft Office Compatibility Pack 2007 SP1 Microsoft Office Compatibility Pack 2007 0 Microsoft Office 2004 for Mac 0

Not Vulnerable:

Discussion

Microsoft Word RTF '\do' Drawing Object Remote Heap Memory Corruption Vulnerability

Microsoft Word is prone to a remote heap memory-corruption vulnerability.

An attacker could exploit this issue by enticing a victim to open a malicious RTF file.

Successfully exploiting this issue would allow the attacker to execute arbitrary code in the context of the currently logged-in user.

Exploit / POC

Microsoft Word RTF '\do' Drawing Object Remote Heap Memory Corruption Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Solution / Fix

Microsoft Word RTF '\do' Drawing Object Remote Heap Memory Corruption Vulnerability

Solution:
The vendor released an advisory and updates to address this issue. Please see the references for more information.

Microsoft Office Word 2003 Viewer SP3

Microsoft Security Update for Microsoft Office Word Viewer 2003 (KB956366)
http://www.microsoft.com/downloads/details.aspx?FamilyId=70de7c3c-519f -4f4a-a03f-027f80b5415c

Microsoft Office Compatibility Pack 2007 SP1

Microsoft Security Update for 2007 Microsoft Office System (KB956828)
http://www.microsoft.com/downloads/details.aspx?FamilyId=55430121-4476 -48b8-9f6f-4a60fa0b2970

Microsoft Word 2003 SP3

Microsoft Security Update for Microsoft Office Word 2003 (KB956357)
http://www.microsoft.com/downloads/details.aspx?FamilyId=45c81c60-4b1b -4246-839b-198ebc4eeae2

Microsoft Outlook 2007 SP1 0

Microsoft Security Update for Microsoft Office Word 2007 (KB956358)
http://www.microsoft.com/downloads/details.aspx?FamilyId=5b51cb5e-3899 -4257-82cf-7e92fa619c37

Microsoft Office 2004 for Mac 0

Microsoft Microsoft Office 2004 for Mac 11.5.3 Update
http://www.microsoft.com/downloads/details.aspx?FamilyId=ECA13AD8-62AE -41A8-B308-41E2D1773820

Microsoft Office Compatibility Pack 2007 0

Microsoft Security Update for 2007 Microsoft Office System (KB956828)
http://www.microsoft.com/downloads/details.aspx?FamilyId=55430121-4476 -48b8-9f6f-4a60fa0b2970

Microsoft Word 2000 SP3

Microsoft Security Update for Microsoft Word 2000 (KB956328)
http://www.microsoft.com/downloads/details.aspx?FamilyId=43e8c4d8-307b -48f6-ac99-a9617421d40a

Microsoft Word 2002 SP3

Microsoft Security Update for Microsoft Word 2002 (KB956329)
http://www.microsoft.com/downloads/details.aspx?FamilyId=3ef41412-50b3 -4077-b0e3-9a3704d2f876

Microsoft Word 2007 SP1

Microsoft Security Update for Microsoft Office Word 2007 (KB956358)
http://www.microsoft.com/downloads/details.aspx?FamilyId=5b51cb5e-3899 -4257-82cf-7e92fa619c37

Microsoft Outlook 2007 0

Microsoft Security Update for Microsoft Office Word 2007 (KB956358)
http://www.microsoft.com/downloads/details.aspx?FamilyId=5b51cb5e-3899 -4257-82cf-7e92fa619c37

References

Microsoft Word RTF '\do' Drawing Object Remote Heap Memory Corruption Vulnerability

References:

Microsoft Word Homepage (Microsoft )
ZDI-08-084: Microsoft Office RTF Consecutive Drawing Object Parsing Heap Corrupt (Zero Day Initiative)
ZDI-08-084: Microsoft Office RTF Consecutive Drawing Object Parsing Heap Corrupt ([email protected] )
Microsoft Security Bulletin MS08-072 (Microsoft)