// For flags

CVE-2008-4028

Microsoft Office RTF Drawing Object Heap Overflow Vulnerability

Severity Score

9.3
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via crafted control words related to multiple Drawing Object tags in (1) an RTF file or (2) a rich text e-mail message, which triggers incorrect memory allocation and a heap-based buffer overflow, aka "Word RTF Object Parsing Vulnerability," a different vulnerability than CVE-2008-4030.

Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3 y 2007 Gold y SP1; Outlook 2007 Gold y SP1; Word Viewer 2003 Gold y SP3; Paquete de compatibilidad de Office para formatos de archivo de Word, Excel y PowerPoint 2007 Gold y SP1; Office 2004 y 2008 para Mac; y Open XML File Format Converter para Mac permite a los atacantes remotos ejecutar código arbitrario por medio de palabras de control creadas relacionadas con múltiples etiquetas de Objeto de Dibujo en (1) un archivo RTF o (2) un mensaje de correo electrónico de texto enriquecido, que activa la asignación de memoria incorrecta y un desbordamiento de búfer en la región heap de la memoria, también se conoce como "Word RTF Object Parsing Vulnerability," una vulnerabilidad diferente a la CVE-2008-4030.

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of various Microsoft products including Word and Outlook. User interaction is required to exploit this vulnerability in that the target must visit a malicious page, open a malicious e-mail, or open a malicious file.
The specific flaw exists within the parsing of RTF documents containing multiple drawing object tags. First, code within wwlib.dll allocates a buffer for the tag object. Later, a result from a call into mso.dll is copied into the same buffer but with a larger size than was allocated by the callee. Successful exploitation can lead to remote compromise of a system under the credentials of the currently logged in user.

*Credits: wushi of team509
CVSS Scores
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2008-09-10 CVE Reserved
  • 2008-12-09 CVE Published
  • 2024-08-07 CVE Updated
  • 2024-10-06 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Microsoft
Search vendor "Microsoft"
Office Outlook
Search vendor "Microsoft" for product "Office Outlook"
2007
Search vendor "Microsoft" for product "Office Outlook" and version "2007"
-
Affected
in Microsoft
Search vendor "Microsoft"
Office
Search vendor "Microsoft" for product "Office"
2000
Search vendor "Microsoft" for product "Office" and version "2000"
sp3
Safe
Microsoft
Search vendor "Microsoft"
Office Outlook
Search vendor "Microsoft" for product "Office Outlook"
2007
Search vendor "Microsoft" for product "Office Outlook" and version "2007"
-
Affected
in Microsoft
Search vendor "Microsoft"
Office
Search vendor "Microsoft" for product "Office"
2003
Search vendor "Microsoft" for product "Office" and version "2003"
sp3
Safe
Microsoft
Search vendor "Microsoft"
Office Outlook
Search vendor "Microsoft" for product "Office Outlook"
2007
Search vendor "Microsoft" for product "Office Outlook" and version "2007"
-
Affected
in Microsoft
Search vendor "Microsoft"
Office
Search vendor "Microsoft" for product "Office"
xp
Search vendor "Microsoft" for product "Office" and version "xp"
sp3
Safe
Microsoft
Search vendor "Microsoft"
Office Outlook
Search vendor "Microsoft" for product "Office Outlook"
2007
Search vendor "Microsoft" for product "Office Outlook" and version "2007"
-
Affected
in Microsoft
Search vendor "Microsoft"
Office System
Search vendor "Microsoft" for product "Office System"
*2007
Safe
Microsoft
Search vendor "Microsoft"
Office Outlook
Search vendor "Microsoft" for product "Office Outlook"
2007
Search vendor "Microsoft" for product "Office Outlook" and version "2007"
-
Affected
in Microsoft
Search vendor "Microsoft"
Office System
Search vendor "Microsoft" for product "Office System"
sp1
Search vendor "Microsoft" for product "Office System" and version "sp1"
2007
Safe
Microsoft
Search vendor "Microsoft"
Office Outlook
Search vendor "Microsoft" for product "Office Outlook"
2007
Search vendor "Microsoft" for product "Office Outlook" and version "2007"
sp1
Affected
in Microsoft
Search vendor "Microsoft"
Office
Search vendor "Microsoft" for product "Office"
2000
Search vendor "Microsoft" for product "Office" and version "2000"
sp3
Safe
Microsoft
Search vendor "Microsoft"
Office Outlook
Search vendor "Microsoft" for product "Office Outlook"
2007
Search vendor "Microsoft" for product "Office Outlook" and version "2007"
sp1
Affected
in Microsoft
Search vendor "Microsoft"
Office
Search vendor "Microsoft" for product "Office"
2003
Search vendor "Microsoft" for product "Office" and version "2003"
sp3
Safe
Microsoft
Search vendor "Microsoft"
Office Outlook
Search vendor "Microsoft" for product "Office Outlook"
2007
Search vendor "Microsoft" for product "Office Outlook" and version "2007"
sp1
Affected
in Microsoft
Search vendor "Microsoft"
Office
Search vendor "Microsoft" for product "Office"
xp
Search vendor "Microsoft" for product "Office" and version "xp"
sp3
Safe
Microsoft
Search vendor "Microsoft"
Office Outlook
Search vendor "Microsoft" for product "Office Outlook"
2007
Search vendor "Microsoft" for product "Office Outlook" and version "2007"
sp1
Affected
in Microsoft
Search vendor "Microsoft"
Office System
Search vendor "Microsoft" for product "Office System"
*2007
Safe
Microsoft
Search vendor "Microsoft"
Office Outlook
Search vendor "Microsoft" for product "Office Outlook"
2007
Search vendor "Microsoft" for product "Office Outlook" and version "2007"
sp1
Affected
in Microsoft
Search vendor "Microsoft"
Office System
Search vendor "Microsoft" for product "Office System"
sp1
Search vendor "Microsoft" for product "Office System" and version "sp1"
2007
Safe
Microsoft
Search vendor "Microsoft"
Office Word
Search vendor "Microsoft" for product "Office Word"
2000
Search vendor "Microsoft" for product "Office Word" and version "2000"
sp3
Affected
in Microsoft
Search vendor "Microsoft"
Office
Search vendor "Microsoft" for product "Office"
2000
Search vendor "Microsoft" for product "Office" and version "2000"
sp3
Safe
Microsoft
Search vendor "Microsoft"
Office Word
Search vendor "Microsoft" for product "Office Word"
2000
Search vendor "Microsoft" for product "Office Word" and version "2000"
sp3
Affected
in Microsoft
Search vendor "Microsoft"
Office
Search vendor "Microsoft" for product "Office"
2003
Search vendor "Microsoft" for product "Office" and version "2003"
sp3
Safe
Microsoft
Search vendor "Microsoft"
Office Word
Search vendor "Microsoft" for product "Office Word"
2000
Search vendor "Microsoft" for product "Office Word" and version "2000"
sp3
Affected
in Microsoft
Search vendor "Microsoft"
Office
Search vendor "Microsoft" for product "Office"
xp
Search vendor "Microsoft" for product "Office" and version "xp"
sp3
Safe
Microsoft
Search vendor "Microsoft"
Office Word
Search vendor "Microsoft" for product "Office Word"
2000
Search vendor "Microsoft" for product "Office Word" and version "2000"
sp3
Affected
in Microsoft
Search vendor "Microsoft"
Office System
Search vendor "Microsoft" for product "Office System"
*2007
Safe
Microsoft
Search vendor "Microsoft"
Office Word
Search vendor "Microsoft" for product "Office Word"
2000
Search vendor "Microsoft" for product "Office Word" and version "2000"
sp3
Affected
in Microsoft
Search vendor "Microsoft"
Office System
Search vendor "Microsoft" for product "Office System"
sp1
Search vendor "Microsoft" for product "Office System" and version "sp1"
2007
Safe
Microsoft
Search vendor "Microsoft"
Office Word
Search vendor "Microsoft" for product "Office Word"
2002
Search vendor "Microsoft" for product "Office Word" and version "2002"
sp3
Affected
in Microsoft
Search vendor "Microsoft"
Office
Search vendor "Microsoft" for product "Office"
2000
Search vendor "Microsoft" for product "Office" and version "2000"
sp3
Safe
Microsoft
Search vendor "Microsoft"
Office Word
Search vendor "Microsoft" for product "Office Word"
2002
Search vendor "Microsoft" for product "Office Word" and version "2002"
sp3
Affected
in Microsoft
Search vendor "Microsoft"
Office
Search vendor "Microsoft" for product "Office"
2003
Search vendor "Microsoft" for product "Office" and version "2003"
sp3
Safe
Microsoft
Search vendor "Microsoft"
Office Word
Search vendor "Microsoft" for product "Office Word"
2002
Search vendor "Microsoft" for product "Office Word" and version "2002"
sp3
Affected
in Microsoft
Search vendor "Microsoft"
Office
Search vendor "Microsoft" for product "Office"
xp
Search vendor "Microsoft" for product "Office" and version "xp"
sp3
Safe
Microsoft
Search vendor "Microsoft"
Office Word
Search vendor "Microsoft" for product "Office Word"
2002
Search vendor "Microsoft" for product "Office Word" and version "2002"
sp3
Affected
in Microsoft
Search vendor "Microsoft"
Office System
Search vendor "Microsoft" for product "Office System"
*2007
Safe
Microsoft
Search vendor "Microsoft"
Office Word
Search vendor "Microsoft" for product "Office Word"
2002
Search vendor "Microsoft" for product "Office Word" and version "2002"
sp3
Affected
in Microsoft
Search vendor "Microsoft"
Office System
Search vendor "Microsoft" for product "Office System"
sp1
Search vendor "Microsoft" for product "Office System" and version "sp1"
2007
Safe
Microsoft
Search vendor "Microsoft"
Office Word
Search vendor "Microsoft" for product "Office Word"
2003
Search vendor "Microsoft" for product "Office Word" and version "2003"
sp3
Affected
in Microsoft
Search vendor "Microsoft"
Office
Search vendor "Microsoft" for product "Office"
2000
Search vendor "Microsoft" for product "Office" and version "2000"
sp3
Safe
Microsoft
Search vendor "Microsoft"
Office Word
Search vendor "Microsoft" for product "Office Word"
2003
Search vendor "Microsoft" for product "Office Word" and version "2003"
sp3
Affected
in Microsoft
Search vendor "Microsoft"
Office
Search vendor "Microsoft" for product "Office"
2003
Search vendor "Microsoft" for product "Office" and version "2003"
sp3
Safe
Microsoft
Search vendor "Microsoft"
Office Word
Search vendor "Microsoft" for product "Office Word"
2003
Search vendor "Microsoft" for product "Office Word" and version "2003"
sp3
Affected
in Microsoft
Search vendor "Microsoft"
Office
Search vendor "Microsoft" for product "Office"
xp
Search vendor "Microsoft" for product "Office" and version "xp"
sp3
Safe
Microsoft
Search vendor "Microsoft"
Office Word
Search vendor "Microsoft" for product "Office Word"
2003
Search vendor "Microsoft" for product "Office Word" and version "2003"
sp3
Affected
in Microsoft
Search vendor "Microsoft"
Office System
Search vendor "Microsoft" for product "Office System"
*2007
Safe
Microsoft
Search vendor "Microsoft"
Office Word
Search vendor "Microsoft" for product "Office Word"
2003
Search vendor "Microsoft" for product "Office Word" and version "2003"
sp3
Affected
in Microsoft
Search vendor "Microsoft"
Office System
Search vendor "Microsoft" for product "Office System"
sp1
Search vendor "Microsoft" for product "Office System" and version "sp1"
2007
Safe
Microsoft
Search vendor "Microsoft"
Office Word
Search vendor "Microsoft" for product "Office Word"
2007
Search vendor "Microsoft" for product "Office Word" and version "2007"
-
Affected
in Microsoft
Search vendor "Microsoft"
Office
Search vendor "Microsoft" for product "Office"
2000
Search vendor "Microsoft" for product "Office" and version "2000"
sp3
Safe
Microsoft
Search vendor "Microsoft"
Office Word
Search vendor "Microsoft" for product "Office Word"
2007
Search vendor "Microsoft" for product "Office Word" and version "2007"
-
Affected
in Microsoft
Search vendor "Microsoft"
Office
Search vendor "Microsoft" for product "Office"
2003
Search vendor "Microsoft" for product "Office" and version "2003"
sp3
Safe
Microsoft
Search vendor "Microsoft"
Office Word
Search vendor "Microsoft" for product "Office Word"
2007
Search vendor "Microsoft" for product "Office Word" and version "2007"
-
Affected
in Microsoft
Search vendor "Microsoft"
Office
Search vendor "Microsoft" for product "Office"
xp
Search vendor "Microsoft" for product "Office" and version "xp"
sp3
Safe
Microsoft
Search vendor "Microsoft"
Office Word
Search vendor "Microsoft" for product "Office Word"
2007
Search vendor "Microsoft" for product "Office Word" and version "2007"
-
Affected
in Microsoft
Search vendor "Microsoft"
Office System
Search vendor "Microsoft" for product "Office System"
*2007
Safe
Microsoft
Search vendor "Microsoft"
Office Word
Search vendor "Microsoft" for product "Office Word"
2007
Search vendor "Microsoft" for product "Office Word" and version "2007"
-
Affected
in Microsoft
Search vendor "Microsoft"
Office System
Search vendor "Microsoft" for product "Office System"
sp1
Search vendor "Microsoft" for product "Office System" and version "sp1"
2007
Safe
Microsoft
Search vendor "Microsoft"
Office
Search vendor "Microsoft" for product "Office"
2004
Search vendor "Microsoft" for product "Office" and version "2004"
mac
Affected
Microsoft
Search vendor "Microsoft"
Office
Search vendor "Microsoft" for product "Office"
2008
Search vendor "Microsoft" for product "Office" and version "2008"
mac
Affected
Microsoft
Search vendor "Microsoft"
Office Compatibility Pack For Word Excel Ppt 2007
Search vendor "Microsoft" for product "Office Compatibility Pack For Word Excel Ppt 2007"
*-
Affected
Microsoft
Search vendor "Microsoft"
Office Compatibility Pack For Word Excel Ppt 2007
Search vendor "Microsoft" for product "Office Compatibility Pack For Word Excel Ppt 2007"
*sp1
Affected
Microsoft
Search vendor "Microsoft"
Office Word Viewer
Search vendor "Microsoft" for product "Office Word Viewer"
2003
Search vendor "Microsoft" for product "Office Word Viewer" and version "2003"
-
Affected
Microsoft
Search vendor "Microsoft"
Office Word Viewer
Search vendor "Microsoft" for product "Office Word Viewer"
2003
Search vendor "Microsoft" for product "Office Word Viewer" and version "2003"
sp3
Affected
Microsoft
Search vendor "Microsoft"
Open Xml File Format Converter
Search vendor "Microsoft" for product "Open Xml File Format Converter"
*mac
Affected
Microsoft
Search vendor "Microsoft"
Works
Search vendor "Microsoft" for product "Works"
8.0
Search vendor "Microsoft" for product "Works" and version "8.0"
-
Affected