|
|
| |
Credit:
The information has been provided by TippingPoint DVLabs.
The original article can be found at: http://dvlabs.tippingpoint.com/advisory/TPTI-08-03
|
| |
Vulnerable Systems:
* Microsoft Office Excel 2003
* Microsoft Office Excel 2002
* Microsoft Office Excel 2000
The specific flaw exists within the parsing of the BIFF file format used by Microsoft Excel. During the processing of a malformed tag a heap allocation can be adversely controlled. When user supplied data is copied to a heap buffer the resulting data results in a arbitrary memory overwrite. If successfully exploited this could lead to system compromise under the credentials of the currently logged in user.
Vendor Response:
Microsoft has issued an update to correct this vulnerability. More details can be found at:
http://www.microsoft.com/technet/security/Bulletin/MS08-014.mspx
Disclosure Timeline:
2007-10-17 - Vulnerability reported to vendor
2008-03-11 - Coordinated public release of advisory
CVE Information:
CVE-2008-0116
|
|
|
