cvelistv5 - cve-2008-3005

CVE-2008-3005 (GCVE-0-2008-3005)

Vulnerability from cvelistv5

Published

2008-08-12 23:00

Modified

2024-08-07 09:21

Severity ?

CWE

Summary

Array index vulnerability in Microsoft Office Excel 2000 SP3 and 2002 SP3, and Office 2004 and 2008 for Mac allows remote attackers to execute arbitrary code via an Excel file with a crafted array index for a FORMAT record, aka the "Excel Index Array Vulnerability."

References

URL

Tags

	http://www.us-cert.gov/cas/techalerts/TA08-225A.html	third-party-advisory, x_refsource_CERT
	http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=741	third-party-advisory, x_refsource_IDEFENSE
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5837	vdb-entry, signature, x_refsource_OVAL
	http://marc.info/?l=bugtraq&m=121915960406986&w=2	vendor-advisory, x_refsource_HP
	http://marc.info/?l=bugtraq&m=121915960406986&w=2	vendor-advisory, x_refsource_HP
	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-043	vendor-advisory, x_refsource_MS
	http://www.securitytracker.com/id?1020671	vdb-entry, x_refsource_SECTRACK
	http://www.securityfocus.com/bid/30639	vdb-entry, x_refsource_BID
	http://secunia.com/advisories/31454	third-party-advisory, x_refsource_SECUNIA
	http://www.vupen.com/english/advisories/2008/2347	vdb-entry, x_refsource_VUPEN

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T09:21:35.040Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "TA08-225A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA08-225A.html"
          },
          {
            "name": "20080812 Microsoft Excel FORMAT Record Invalid Array Index Vulnerability",
            "tags": [
              "third-party-advisory",
              "x_refsource_IDEFENSE",
              "x_transferred"
            ],
            "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=741"
          },
          {
            "name": "oval:org.mitre.oval:def:5837",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5837"
          },
          {
            "name": "HPSBST02360",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=121915960406986\u0026w=2"
          },
          {
            "name": "SSRT080117",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=121915960406986\u0026w=2"
          },
          {
            "name": "MS08-043",
            "tags": [
              "vendor-advisory",
              "x_refsource_MS",
              "x_transferred"
            ],
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-043"
          },
          {
            "name": "1020671",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1020671"
          },
          {
            "name": "30639",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/30639"
          },
          {
            "name": "31454",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/31454"
          },
          {
            "name": "ADV-2008-2347",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/2347"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-08-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Array index vulnerability in Microsoft Office Excel 2000 SP3 and 2002 SP3, and Office 2004 and 2008 for Mac allows remote attackers to execute arbitrary code via an Excel file with a crafted array index for a FORMAT record, aka the \"Excel Index Array Vulnerability.\""
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-12T19:57:01.000Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "TA08-225A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA08-225A.html"
        },
        {
          "name": "20080812 Microsoft Excel FORMAT Record Invalid Array Index Vulnerability",
          "tags": [
            "third-party-advisory",
            "x_refsource_IDEFENSE"
          ],
          "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=741"
        },
        {
          "name": "oval:org.mitre.oval:def:5837",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5837"
        },
        {
          "name": "HPSBST02360",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=121915960406986\u0026w=2"
        },
        {
          "name": "SSRT080117",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=121915960406986\u0026w=2"
        },
        {
          "name": "MS08-043",
          "tags": [
            "vendor-advisory",
            "x_refsource_MS"
          ],
          "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-043"
        },
        {
          "name": "1020671",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1020671"
        },
        {
          "name": "30639",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/30639"
        },
        {
          "name": "31454",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/31454"
        },
        {
          "name": "ADV-2008-2347",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/2347"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2008-3005",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Array index vulnerability in Microsoft Office Excel 2000 SP3 and 2002 SP3, and Office 2004 and 2008 for Mac allows remote attackers to execute arbitrary code via an Excel file with a crafted array index for a FORMAT record, aka the \"Excel Index Array Vulnerability.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "TA08-225A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA08-225A.html"
            },
            {
              "name": "20080812 Microsoft Excel FORMAT Record Invalid Array Index Vulnerability",
              "refsource": "IDEFENSE",
              "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=741"
            },
            {
              "name": "oval:org.mitre.oval:def:5837",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5837"
            },
            {
              "name": "HPSBST02360",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=121915960406986\u0026w=2"
            },
            {
              "name": "SSRT080117",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=121915960406986\u0026w=2"
            },
            {
              "name": "MS08-043",
              "refsource": "MS",
              "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-043"
            },
            {
              "name": "1020671",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1020671"
            },
            {
              "name": "30639",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/30639"
            },
            {
              "name": "31454",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/31454"
            },
            {
              "name": "ADV-2008-2347",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/2347"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2008-3005",
    "datePublished": "2008-08-12T23:00:00.000Z",
    "dateReserved": "2008-07-07T00:00:00.000Z",
    "dateUpdated": "2024-08-07T09:21:35.040Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CERTA-2008-AVI-404

Vulnerability from certfr_avis

Plusieurs vulnérabilités ont été identifiées dans l'application bureautique Microsoft Excel. Elles peuvent être exploitées à distance via un fichier spécialement construit afin d'exécuter des commandes arbitraires sur le système vulnérable sur lequel le document serait ouvert.

Description

Plusieurs vulnérabilités ont été identifiées dans l'application bureautique Microsoft Excel :

l'application ne manipule pas correctement les enregistrements FORMAT dans un document Excel servant à l'indexation de tables ;
l'application ne manipule pas correctement les enregistrements AxesSet de graphiques inclus dans un document Excel ;
l'application ne traite pas correctement les formats de fichiers BIFF et en particulier les enregistrements COUNTRY ;
l'application ne détruit pas correctement la chaîne de caractères servant de mot de passe quand le fichier est paramétré pour ne pas paramétré pour ne pas enregistrer le mot de passe de session de données distant.

Ces vulnérabilités peuvent être exploitées et provoquer une corruption de mémoire afin d'exécuter du code arbitraire.

Solution

Se référer au bulletin de sécurité MS08-043 de Microsoft pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Microsoft	Office	Microsoft Office Excel Viewer 2003 Service Pack ;
Microsoft	N/A	Microsoft Excel 2002 Service Pack 3 ;
Microsoft	Office	Microsoft Office SharePoint Server 2007 x64 Edition ;
Microsoft	Office	Microsoft Office SharePoint Server 2007 Service Pack 1 ;
Microsoft	Office	Microsoft Office 2008 pour Mac.
Microsoft	Office	Microsoft Office SharePoint Server 2007 ;
Microsoft	Office	Microsoft Office SharePoint Server 2007 Service Pack 1 x64 Edition ;
Microsoft	Office	Microsoft Office Excel Viewer 2003 ;
Microsoft	Office	Microsoft Office Excel Viewer ;
Microsoft	N/A	Microsoft Excel 2003 Service Pack 3 ;
Microsoft	Office	Microsoft Office Compatibility Pack pour les formats Office 2007 ;
Microsoft	N/A	Microsoft Excel 2007 Service Pack 1 ;
Microsoft	N/A	Microsoft Excel 2000 Service Pack 3 ;
Microsoft	N/A	Microsoft Excel 2007 ;
Microsoft	Office	Microsoft Office Compatibility Pack pour les formats Office 2007 Service Pack 1 ;
Microsoft	Office	Microsoft Office 2004 pour Mac ;
Microsoft	N/A	Microsoft Excel 2003 Service Pack 2 ;

References

Title

Publication Time

Tags

Bulletin de sécurité Microsoft MS08-043 du 12 août 2008	None	vendor-advisory
Avis de sécurité TippingPoint ZDI-08-048 du 12 août 2008 :	-	other
Avis de sécurité iDefense du 12 août 2008 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Microsoft Office Excel Viewer 2003 Service Pack ;",
      "product": {
        "name": "Office",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Excel 2002 Service Pack 3 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Office SharePoint Server 2007 x64 Edition ;",
      "product": {
        "name": "Office",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Office SharePoint Server 2007 Service Pack 1 ;",
      "product": {
        "name": "Office",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Office 2008 pour Mac.",
      "product": {
        "name": "Office",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Office SharePoint Server 2007 ;",
      "product": {
        "name": "Office",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Office SharePoint Server 2007 Service Pack 1 x64 Edition ;",
      "product": {
        "name": "Office",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Office Excel Viewer 2003 ;",
      "product": {
        "name": "Office",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Office Excel Viewer ;",
      "product": {
        "name": "Office",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Excel 2003 Service Pack 3 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Office Compatibility Pack pour les formats Office 2007 ;",
      "product": {
        "name": "Office",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Excel 2007 Service Pack 1 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Excel 2000 Service Pack 3 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Excel 2007 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Office Compatibility Pack pour les formats Office 2007 Service Pack 1 ;",
      "product": {
        "name": "Office",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Office 2004 pour Mac ;",
      "product": {
        "name": "Office",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Excel 2003 Service Pack 2 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nPlusieurs vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 identifi\u00e9es dans l\u0027application\nbureautique Microsoft Excel\u00a0:\n\n-   l\u0027application ne manipule pas correctement les enregistrements\n    FORMAT dans un document Excel servant \u00e0 l\u0027indexation de tables ;\n-   l\u0027application ne manipule pas correctement les enregistrements\n    AxesSet de graphiques inclus dans un document Excel ;\n-   l\u0027application ne traite pas correctement les formats de fichiers\n    BIFF et en particulier les enregistrements COUNTRY ;\n-   l\u0027application ne d\u00e9truit pas correctement la cha\u00eene de caract\u00e8res\n    servant de mot de passe quand le fichier est param\u00e9tr\u00e9 pour ne pas\n    param\u00e9tr\u00e9 pour ne pas enregistrer le mot de passe de session de\n    donn\u00e9es distant.\n\nCes vuln\u00e9rabilit\u00e9s peuvent \u00eatre exploit\u00e9es et provoquer une corruption\nde m\u00e9moire afin d\u0027ex\u00e9cuter du code arbitraire.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 MS08-043 de Microsoft pour\nl\u0027obtention des correctifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2008-3004",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-3004"
    },
    {
      "name": "CVE-2008-3005",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-3005"
    },
    {
      "name": "CVE-2008-3006",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-3006"
    },
    {
      "name": "CVE-2008-3003",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-3003"
    }
  ],
  "initial_release_date": "2008-08-13T00:00:00",
  "last_revision_date": "2008-08-13T00:00:00",
  "links": [
    {
      "title": "Avis de s\u00e9curit\u00e9 TippingPoint ZDI-08-048 du 12 ao\u00fbt 2008 :",
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-08-048"
    },
    {
      "title": "Avis de s\u00e9curit\u00e9 iDefense du 12 ao\u00fbt 2008 :",
      "url": "http://labs.idefense.com/intelligence/vulnerabilities/"
    }
  ],
  "reference": "CERTA-2008-AVI-404",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2008-08-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Plusieurs vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 identifi\u00e9es dans l\u0027application\nbureautique Microsoft Excel. Elles peuvent \u00eatre exploit\u00e9es \u00e0 distance\nvia un fichier sp\u00e9cialement construit afin d\u0027ex\u00e9cuter des commandes\narbitraires sur le syst\u00e8me vuln\u00e9rable sur lequel le document serait\nouvert.\n",
  "title": "Vuln\u00e9rabilit\u00e9s dans Microsoft Excel",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft MS08-043 du 12 ao\u00fbt 2008",
      "url": "http://www.microsoft.com/technet/security/Bulletin/MS08-043.mspx"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2008-3005 (GCVE-0-2008-3005)

Vulnerability from cvelistv5

CERTA-2008-AVI-404

Vulnerability from certfr_avis

Description

Solution

Tags

Sightings

Nomenclature