CVE-2008-4027
Microsoft Office RTF Consecutive Drawing Object Parsing Heap Corruption Vulnerability
Severity Score
9.3
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Double free vulnerability in Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; and Office 2004 for Mac allow remote attackers to execute arbitrary code via a crafted (1) RTF file or (2) rich text e-mail message with multiple consecutive Drawing Object ("\do") tags, which triggers a "memory calculation error" and memory corruption, aka "Word RTF Object Parsing Vulnerability."
Vulnerabilidad de Doble Liberación en Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3 y 2007 Gold y SP1; Outlook 2007 Gold y SP1; Word Viewer 2003 Gold y SP3; Paquete de compatibilidad de Office para formatos de archivo de Word, Excel y PowerPoint 2007 Gold y SP1; y Office 2004 para Mac permite a los atacantes remotos ejecutar código arbitrario por medio de un (1) archivo RTF o (2) un mensaje de correo electrónico de texto enriquecido con múltiples etiquetas consecutivas de Objeto de Dibujo ("\do"), que desencadena una "memory calculation error" y una corrupción de memoria, también se conoce como "Word RTF Object Parsing Vulnerability."
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Office. User interaction is required to exploit this vulnerability in that the target must visit a malicious page, open a malicious e-mail, or open a malicious file.
The specific flaw exists when parsing malformed RTF documents. When processing consecutive "\do" Drawing Object tags mso.dll does not properly verify the integrity of the object and frees a memory buffer twice, leading to heap corruption. Successful exploitation can lead to remote compromise of a system under the credentials of the currently logged in user.
*Credits:
wushi of team509
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2008-09-10 CVE Reserved
- 2008-12-09 CVE Published
- 2024-08-07 CVE Updated
- 2024-10-06 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-399: Resource Management Errors
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/archive/1/499062/100/0/threaded | Mailing List | |
| http://www.securitytracker.com/id?1021370 | Vdb Entry | |
| http://www.us-cert.gov/cas/techalerts/TA08-344A.html | Third Party Advisory | |
| http://www.zerodayinitiative.com/advisories/ZDI-08-084 | X_refsource_misc |
|
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6098 | Signature |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://www.vupen.com/english/advisories/2008/3384 | 2018-10-30 | |
| https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-072 | 2018-10-30 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Microsoft Search vendor "Microsoft" | Office Outlook Search vendor "Microsoft" for product "Office Outlook" | 2007 Search vendor "Microsoft" for product "Office Outlook" and version "2007" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Office Search vendor "Microsoft" for product "Office" | 2000 Search vendor "Microsoft" for product "Office" and version "2000" | sp3 |
Safe
|
| Microsoft Search vendor "Microsoft" | Office Outlook Search vendor "Microsoft" for product "Office Outlook" | 2007 Search vendor "Microsoft" for product "Office Outlook" and version "2007" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Office Search vendor "Microsoft" for product "Office" | 2003 Search vendor "Microsoft" for product "Office" and version "2003" | sp3 |
Safe
|
| Microsoft Search vendor "Microsoft" | Office Outlook Search vendor "Microsoft" for product "Office Outlook" | 2007 Search vendor "Microsoft" for product "Office Outlook" and version "2007" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Office Search vendor "Microsoft" for product "Office" | xp Search vendor "Microsoft" for product "Office" and version "xp" | sp3 |
Safe
|
| Microsoft Search vendor "Microsoft" | Office Outlook Search vendor "Microsoft" for product "Office Outlook" | 2007 Search vendor "Microsoft" for product "Office Outlook" and version "2007" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Office System Search vendor "Microsoft" for product "Office System" | * | 2007 |
Safe
|
| Microsoft Search vendor "Microsoft" | Office Outlook Search vendor "Microsoft" for product "Office Outlook" | 2007 Search vendor "Microsoft" for product "Office Outlook" and version "2007" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Office System Search vendor "Microsoft" for product "Office System" | sp1 Search vendor "Microsoft" for product "Office System" and version "sp1" | 2007 |
Safe
|
| Microsoft Search vendor "Microsoft" | Office Outlook Search vendor "Microsoft" for product "Office Outlook" | 2007 Search vendor "Microsoft" for product "Office Outlook" and version "2007" | sp1 |
Affected
| in | Microsoft Search vendor "Microsoft" | Office Search vendor "Microsoft" for product "Office" | 2000 Search vendor "Microsoft" for product "Office" and version "2000" | sp3 |
Safe
|
| Microsoft Search vendor "Microsoft" | Office Outlook Search vendor "Microsoft" for product "Office Outlook" | 2007 Search vendor "Microsoft" for product "Office Outlook" and version "2007" | sp1 |
Affected
| in | Microsoft Search vendor "Microsoft" | Office Search vendor "Microsoft" for product "Office" | 2003 Search vendor "Microsoft" for product "Office" and version "2003" | sp3 |
Safe
|
| Microsoft Search vendor "Microsoft" | Office Outlook Search vendor "Microsoft" for product "Office Outlook" | 2007 Search vendor "Microsoft" for product "Office Outlook" and version "2007" | sp1 |
Affected
| in | Microsoft Search vendor "Microsoft" | Office Search vendor "Microsoft" for product "Office" | xp Search vendor "Microsoft" for product "Office" and version "xp" | sp3 |
Safe
|
| Microsoft Search vendor "Microsoft" | Office Outlook Search vendor "Microsoft" for product "Office Outlook" | 2007 Search vendor "Microsoft" for product "Office Outlook" and version "2007" | sp1 |
Affected
| in | Microsoft Search vendor "Microsoft" | Office System Search vendor "Microsoft" for product "Office System" | * | 2007 |
Safe
|
| Microsoft Search vendor "Microsoft" | Office Outlook Search vendor "Microsoft" for product "Office Outlook" | 2007 Search vendor "Microsoft" for product "Office Outlook" and version "2007" | sp1 |
Affected
| in | Microsoft Search vendor "Microsoft" | Office System Search vendor "Microsoft" for product "Office System" | sp1 Search vendor "Microsoft" for product "Office System" and version "sp1" | 2007 |
Safe
|
| Microsoft Search vendor "Microsoft" | Office Word Search vendor "Microsoft" for product "Office Word" | 2000 Search vendor "Microsoft" for product "Office Word" and version "2000" | sp3 |
Affected
| in | Microsoft Search vendor "Microsoft" | Office Search vendor "Microsoft" for product "Office" | 2000 Search vendor "Microsoft" for product "Office" and version "2000" | sp3 |
Safe
|
| Microsoft Search vendor "Microsoft" | Office Word Search vendor "Microsoft" for product "Office Word" | 2000 Search vendor "Microsoft" for product "Office Word" and version "2000" | sp3 |
Affected
| in | Microsoft Search vendor "Microsoft" | Office Search vendor "Microsoft" for product "Office" | 2003 Search vendor "Microsoft" for product "Office" and version "2003" | sp3 |
Safe
|
| Microsoft Search vendor "Microsoft" | Office Word Search vendor "Microsoft" for product "Office Word" | 2000 Search vendor "Microsoft" for product "Office Word" and version "2000" | sp3 |
Affected
| in | Microsoft Search vendor "Microsoft" | Office Search vendor "Microsoft" for product "Office" | xp Search vendor "Microsoft" for product "Office" and version "xp" | sp3 |
Safe
|
| Microsoft Search vendor "Microsoft" | Office Word Search vendor "Microsoft" for product "Office Word" | 2000 Search vendor "Microsoft" for product "Office Word" and version "2000" | sp3 |
Affected
| in | Microsoft Search vendor "Microsoft" | Office System Search vendor "Microsoft" for product "Office System" | * | 2007 |
Safe
|
| Microsoft Search vendor "Microsoft" | Office Word Search vendor "Microsoft" for product "Office Word" | 2000 Search vendor "Microsoft" for product "Office Word" and version "2000" | sp3 |
Affected
| in | Microsoft Search vendor "Microsoft" | Office System Search vendor "Microsoft" for product "Office System" | sp1 Search vendor "Microsoft" for product "Office System" and version "sp1" | 2007 |
Safe
|
| Microsoft Search vendor "Microsoft" | Office Word Search vendor "Microsoft" for product "Office Word" | 2002 Search vendor "Microsoft" for product "Office Word" and version "2002" | sp3 |
Affected
| in | Microsoft Search vendor "Microsoft" | Office Search vendor "Microsoft" for product "Office" | 2000 Search vendor "Microsoft" for product "Office" and version "2000" | sp3 |
Safe
|
| Microsoft Search vendor "Microsoft" | Office Word Search vendor "Microsoft" for product "Office Word" | 2002 Search vendor "Microsoft" for product "Office Word" and version "2002" | sp3 |
Affected
| in | Microsoft Search vendor "Microsoft" | Office Search vendor "Microsoft" for product "Office" | 2003 Search vendor "Microsoft" for product "Office" and version "2003" | sp3 |
Safe
|
| Microsoft Search vendor "Microsoft" | Office Word Search vendor "Microsoft" for product "Office Word" | 2002 Search vendor "Microsoft" for product "Office Word" and version "2002" | sp3 |
Affected
| in | Microsoft Search vendor "Microsoft" | Office Search vendor "Microsoft" for product "Office" | xp Search vendor "Microsoft" for product "Office" and version "xp" | sp3 |
Safe
|
| Microsoft Search vendor "Microsoft" | Office Word Search vendor "Microsoft" for product "Office Word" | 2002 Search vendor "Microsoft" for product "Office Word" and version "2002" | sp3 |
Affected
| in | Microsoft Search vendor "Microsoft" | Office System Search vendor "Microsoft" for product "Office System" | * | 2007 |
Safe
|
| Microsoft Search vendor "Microsoft" | Office Word Search vendor "Microsoft" for product "Office Word" | 2002 Search vendor "Microsoft" for product "Office Word" and version "2002" | sp3 |
Affected
| in | Microsoft Search vendor "Microsoft" | Office System Search vendor "Microsoft" for product "Office System" | sp1 Search vendor "Microsoft" for product "Office System" and version "sp1" | 2007 |
Safe
|
| Microsoft Search vendor "Microsoft" | Office Word Search vendor "Microsoft" for product "Office Word" | 2003 Search vendor "Microsoft" for product "Office Word" and version "2003" | sp3 |
Affected
| in | Microsoft Search vendor "Microsoft" | Office Search vendor "Microsoft" for product "Office" | 2000 Search vendor "Microsoft" for product "Office" and version "2000" | sp3 |
Safe
|
| Microsoft Search vendor "Microsoft" | Office Word Search vendor "Microsoft" for product "Office Word" | 2003 Search vendor "Microsoft" for product "Office Word" and version "2003" | sp3 |
Affected
| in | Microsoft Search vendor "Microsoft" | Office Search vendor "Microsoft" for product "Office" | 2003 Search vendor "Microsoft" for product "Office" and version "2003" | sp3 |
Safe
|
| Microsoft Search vendor "Microsoft" | Office Word Search vendor "Microsoft" for product "Office Word" | 2003 Search vendor "Microsoft" for product "Office Word" and version "2003" | sp3 |
Affected
| in | Microsoft Search vendor "Microsoft" | Office Search vendor "Microsoft" for product "Office" | xp Search vendor "Microsoft" for product "Office" and version "xp" | sp3 |
Safe
|
| Microsoft Search vendor "Microsoft" | Office Word Search vendor "Microsoft" for product "Office Word" | 2003 Search vendor "Microsoft" for product "Office Word" and version "2003" | sp3 |
Affected
| in | Microsoft Search vendor "Microsoft" | Office System Search vendor "Microsoft" for product "Office System" | * | 2007 |
Safe
|
| Microsoft Search vendor "Microsoft" | Office Word Search vendor "Microsoft" for product "Office Word" | 2003 Search vendor "Microsoft" for product "Office Word" and version "2003" | sp3 |
Affected
| in | Microsoft Search vendor "Microsoft" | Office System Search vendor "Microsoft" for product "Office System" | sp1 Search vendor "Microsoft" for product "Office System" and version "sp1" | 2007 |
Safe
|
| Microsoft Search vendor "Microsoft" | Office Word Search vendor "Microsoft" for product "Office Word" | 2007 Search vendor "Microsoft" for product "Office Word" and version "2007" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Office Search vendor "Microsoft" for product "Office" | 2000 Search vendor "Microsoft" for product "Office" and version "2000" | sp3 |
Safe
|
| Microsoft Search vendor "Microsoft" | Office Word Search vendor "Microsoft" for product "Office Word" | 2007 Search vendor "Microsoft" for product "Office Word" and version "2007" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Office Search vendor "Microsoft" for product "Office" | 2003 Search vendor "Microsoft" for product "Office" and version "2003" | sp3 |
Safe
|
| Microsoft Search vendor "Microsoft" | Office Word Search vendor "Microsoft" for product "Office Word" | 2007 Search vendor "Microsoft" for product "Office Word" and version "2007" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Office Search vendor "Microsoft" for product "Office" | xp Search vendor "Microsoft" for product "Office" and version "xp" | sp3 |
Safe
|
| Microsoft Search vendor "Microsoft" | Office Word Search vendor "Microsoft" for product "Office Word" | 2007 Search vendor "Microsoft" for product "Office Word" and version "2007" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Office System Search vendor "Microsoft" for product "Office System" | * | 2007 |
Safe
|
| Microsoft Search vendor "Microsoft" | Office Word Search vendor "Microsoft" for product "Office Word" | 2007 Search vendor "Microsoft" for product "Office Word" and version "2007" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Office System Search vendor "Microsoft" for product "Office System" | sp1 Search vendor "Microsoft" for product "Office System" and version "sp1" | 2007 |
Safe
|
| Microsoft Search vendor "Microsoft" | Office Search vendor "Microsoft" for product "Office" | 2004 Search vendor "Microsoft" for product "Office" and version "2004" | mac |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Office Search vendor "Microsoft" for product "Office" | 2008 Search vendor "Microsoft" for product "Office" and version "2008" | mac |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Office Compatibility Pack For Word Excel Ppt 2007 Search vendor "Microsoft" for product "Office Compatibility Pack For Word Excel Ppt 2007" | * | - |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Office Compatibility Pack For Word Excel Ppt 2007 Search vendor "Microsoft" for product "Office Compatibility Pack For Word Excel Ppt 2007" | * | sp1 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Office Word Viewer Search vendor "Microsoft" for product "Office Word Viewer" | 2003 Search vendor "Microsoft" for product "Office Word Viewer" and version "2003" | - |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Office Word Viewer Search vendor "Microsoft" for product "Office Word Viewer" | 2003 Search vendor "Microsoft" for product "Office Word Viewer" and version "2003" | sp3 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Open Xml File Format Converter Search vendor "Microsoft" for product "Open Xml File Format Converter" | * | mac |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Works Search vendor "Microsoft" for product "Works" | 8.0 Search vendor "Microsoft" for product "Works" and version "8.0" | - |
Affected
| ||||||