Microsoft Excel Malformed Object Handling Remote Code Execution Vulnerability

Bugtraq ID:	32618
Class:	Unknown
CVE:	CVE-2008-4265
Remote:	Yes
Local:	No
Published:	Dec 09 2008 12:00AM
Updated:	Dec 10 2008 09:41PM
Credit:	Joshua J. Drake of iDefense.
Vulnerable:	Microsoft Excel 2000 SP3 + Microsoft Office 2000 SP3 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional
Not Vulnerable:

Microsoft Excel Malformed Object Handling Remote Code Execution Vulnerability

Microsoft Excel is prone to a remote code-execution vulnerability.

Attackers may exploit this issue by enticing victims into opening a maliciously crafted Excel file.

Successful exploits may allow attackers to execute arbitrary code with the privileges of the user running the application.

Microsoft Excel Malformed Object Handling Remote Code Execution Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft Excel Malformed Object Handling Remote Code Execution Vulnerability

Solution:
Microsoft has released a security bulletin along with fixes that address this vulnerability.


Microsoft Excel 2000 SP3

• Microsoft Security Update for Microsoft Excel 2000 (KB958435)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=f39d2a49-f861 -4f2d-bf91-94a8a85af40c

Microsoft Excel Malformed Object Handling Remote Code Execution Vulnerability

References:

• Microsoft Excel Homepage (Microsoft )
  
• Microsoft Excel Malformed Object Memoy Corruption Vulnerability (iDefense Labs)
  
• iDefense Security Advisory 12.10.08: Microsoft Excel Malformed Object Memoy Corr (iDefense Labs )
  
• Microsoft Security Bulletin MS08-074 (Microsoft)