Advisories » Microsoft Excel File Handling Remote Arbitrary Code Execution Vulnerability

Release Date:	16/01/2008	Severity:	Extremely Critical
SecWatch Advisory:	SWID1020078	Cause:	Not specified
Solution Status:	Unpatched	Impact:	Execution of arbitrary code
Exploit Status:	None Available	Access Vector:	From remote

Affected Software:	Microsoft Excel 2000 Microsoft Excel 2002 Microsoft Excel 2003 Microsoft Excel Viewer 2003 Microsoft Office 2000 Microsoft Office 2003 Professional Edition Microsoft Office 2003 Small Business Edition Microsoft Office 2003 Standard Edition Microsoft Office 2003 Student and Teacher Edition Microsoft Office 2004 for Mac Microsoft Office 2007 Microsoft Office 2008 for Mac Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 20 Microsoft Office Excel 2007

Original Advisory:	http://www.microsoft.com/technet/security/advisory/947563.mspx
References:	FrSIRT/ADV-2008-0146
CVE:	CVE-2008-0081 CVE-2008-0111 CVE-2008-0112 CVE-2008-0114 CVE-2008-0115 CVE-2008-0116 CVE-2008-0117
Microsoft:	MS08-014
Secunia:	SA28506
Bugtraq ID:	BID#27305

Description:

A vulnerability in Microsoft Excel has been reported, which can be exploited by remote users to compromise a user's system.

An unspecified error exists when handling Excel files with malformed header information, which and can be exploited to execute arbitrary code by e.g. tricking a user to opening a malicious Excel file.

Affected:

Microsoft Office Excel 2003 Service Pack 2
Microsoft Office Excel Viewer 2003
Microsoft Office Excel 2002
Microsoft Office Excel 2000
Microsoft Excel 2004 for Mac

Solution:

The vulnerability has been fixed, apply patches:
http://www.microsoft.com/techn...ecurity/Bulletin/MS08-014.mspx

Credits:

Unknown