Vulnerabilities > CVE-2008-3019 - Resource Management Errors vulnerability in Microsoft Office, Office Converter Pack and Works
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
Microsoft Office 2000 SP3, XP SP3, and 2003 SP2; Office Converter Pack; and Works 8 do not properly parse the length of an Encapsulated PostScript (EPS) file, which allows remote attackers to execute arbitrary code via a crafted EPS file, aka the "Malformed EPS Filter Vulnerability."
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 5 |
Common Weakness Enumeration (CWE)
Nessus
| NASL family | Windows : Microsoft Bulletins |
| NASL id | SMB_NT_MS08-044.NASL |
| description | The remote host is running a version of some Microsoft Office filters that are subject to various flaws that could allow arbitrary code to be run. An attacker may use these to execute arbitrary code on this host. To succeed, the attacker would have to send a rogue file to a user of the remote computer and have it import it with Microsoft Office. |
| last seen | 2020-06-01 |
| modified | 2020-06-02 |
| plugin id | 33873 |
| published | 2008-08-13 |
| reporter | This script is Copyright (C) 2008-2018 Tenable Network Security, Inc. |
| source | https://www.tenable.com/plugins/nessus/33873 |
| title | MS08-044: Vulnerabilities in Microsoft Office Filters Could Allow Remote Code Execution (924090) |
Oval
| accepted | 2015-08-10T04:01:02.992-04:00 | ||||||||||||||||||||
| class | vulnerability | ||||||||||||||||||||
| contributors |
| ||||||||||||||||||||
| definition_extensions |
| ||||||||||||||||||||
| description | Microsoft Office 2000 SP3, XP SP3, and 2003 SP2; Office Converter Pack; and Works 8 do not properly parse the length of an Encapsulated PostScript (EPS) file, which allows remote attackers to execute arbitrary code via a crafted EPS file, aka the "Malformed EPS Filter Vulnerability." | ||||||||||||||||||||
| family | windows | ||||||||||||||||||||
| id | oval:org.mitre.oval:def:6122 | ||||||||||||||||||||
| status | accepted | ||||||||||||||||||||
| submitted | 2008-08-13T09:28:00 | ||||||||||||||||||||
| title | Microsoft Malformed EPS Filter Vulnerability | ||||||||||||||||||||
| version | 15 |
Seebug
| bulletinFamily | exploit |
| description | BUGTRAQ ID: 30595,30597 CVE(CAN) ID: CVE-2008-3019,CVE-2008-3018 Microsoft Office是非常流行的办公软件套件。 Microsoft Office过滤器处理畸形图像的方式中存在远程执行代码漏洞，攻击者可以通过构建特制封装的PostScript（EPS）或PICT文件来利用此漏洞。如果用户使用Office应用程序打开该文件，可能允许远程执行代码。此类特制文件可能包括在电子邮件附件中，或者宿主在恶意网站或受危害网站上。成功利用此漏洞的攻击者可以完全控制受影响的系统。不过，要利用此漏洞，需要进行大量用户交互。 Microsoft Office XP SP3 Microsoft Office 2003 Service Pack 2 Microsoft Office 2000 SP3 Microsoft Works 8.0 临时解决方法： * 修改存取控制表以拒绝所有用户对EPSIMP32.FLT的访问 注册表方法 1. 单击“开始”，单击“运行”，键入regedit.exe，然后单击“确定”。 2. 导航到HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Graphics Filters\Import\EPS 3. 记下Path的值。在资源管理器中，导航到作为Path值列出的EPSIMP32.FLT文件。 4. 右键单击EPSIMP32.FLT文件并选择“属性”。 5. 在“安全”选项卡上单击“高级”。 6. 取消选择“允许可继承的权限从父对象传送到此对象...”并单击“删除”。 7. 单击“确定”、“是”和“确定”。 脚本方法 对于Windows XP的所有受支持的32位版本，通过命令提示符运行以下命令： cacls "%ProgramFiles%\Common Files\Microsoft Shared\GRPHFLT\EPSIMP32.FLT" /E /P everyone:N 对于Windows XP的所有受支持的基于x64的版本，通过命令提示符运行以下命令： cacls "%ProgramFiles(x86)%\Common Files\Microsoft Shared\GRPHFLT\EPSIMP32.FLT" /E /P everyone:N 对于Windows Vista和Windows Server 2008的所有受支持的32位版本，以管理员身份通过命令提示符运行下列命令： takeown /f "%ProgramFiles%\Common Files\Microsoft Shared\GRPHFLT\EPSIMP32.FLT" icacls "%ProgramFiles%\Common Files\Microsoft Shared\GRPHFLT\EPSIMP32.FLT" /save %TEMP%\ EPSIMP32 _ACL.TXT icacls "%ProgramFiles%\Common Files\Microsoft Shared\GRPHFLT\EPSIMP32.FLT" /deny everyone:(F) 对于Windows Vista和Windows Server 2008的所有受支持的基于x64的版本，以管理员身份通过命令提示符运行下列命令： takeown /f "%ProgramFiles(x86)%\Common Files\Microsoft Shared\GRPHFLT\EPSIMP32.FLT" icacls "%ProgramFiles(x86)%\Common Files\Microsoft Shared\GRPHFLT\EPSIMP32.FLT" /save %TEMP%\ EPSIMP32 _ACL.TXT icacls "%ProgramFiles(x86)%\Common Files\Microsoft Shared\GRPHFLT\EPSIMP32.FLT" /deny everyone:(F) * 修改存取控制表以拒绝所有用户对PICTIM32.FLT的访问 注册表方法 1. 单击“开始”，单击“运行”，键入regedit.exe，然后单击“确定”。 2. 导航到HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Graphics Filters\Import\PICT 3. 记下Path的值。在资源管理器中，导航到作为Path的值列出的PICTIM32.FLT文 件。 4. 右键单击PICTIM32.FLT文件并选择“属性”。 5. 在“安全”选项卡上单击“高级”。 6. 取消选择“允许可继承的权限从父对象传送到此对象...”并单击“删除”。 7. 单击“确定”、“是”和“确定”。 脚本方法 对于Windows XP的所有受支持的32位版本，通过命令提示符运行以下命令： cacls "%ProgramFiles%\Common Files\Microsoft Shared\GRPHFLT\PICTIM32.FLT" /E /P everyone:N 对于Windows XP的所有受支持的基于x64的版本，通过命令提示符运行以下命令： cacls "%ProgramFiles(x86)%\Common Files\Microsoft Shared\GRPHFLT\PICTIM32.FLT" /E /P everyone:N 对于Windows Vista和Windows Server 2008的所有受支持的32位版本，以管理员身份通过命令提示符运行下列命令： takeown /f "%ProgramFiles%\Common Files\Microsoft Shared\GRPHFLT\PICTIM32.FLT" icacls "%ProgramFiles%\Common Files\Microsoft Shared\GRPHFLT\PICTIM32.FLT" /save %TEMP%\ PICTIM32 _ACL.TXT icacls "%ProgramFiles%\Common Files\Microsoft Shared\GRPHFLT\PICTIM32.FLT" /deny everyone:(F) 对于Windows Vista和Windows Server 2008的所有受支持的基于x64的版本，以管理员身份通过命令提示符运行下列命令： takeown /f "%ProgramFiles(x86)%\Common Files\Microsoft Shared\GRPHFLT\PICTIM32.FLT" icacls "%ProgramFiles(x86)%\Common Files\Microsoft Shared\GRPHFLT\PICTIM32.FLT" /save %TEMP%\ PICTIM32 _ACL.TXT icacls "%ProgramFiles(x86)%\Common Files\Microsoft Shared\GRPHFLT\PICTIM32.FLT" /deny everyone:(F) * 不要打开或保存从不受信任来源或从受信任来源意外收到的Microsoft Office文件。 厂商补丁： Microsoft --------- Microsoft已经为此发布了一个安全公告（MS08-044）以及相应补丁: MS08-044：Vulnerabilities in Microsoft Office Filters Could Allow Remote Code Execution (924090) 链接：<a href=http://www.microsoft.com/technet/security/bulletin/MS08-044.mspx?pf=true target=_blank>http://www.microsoft.com/technet/security/bulletin/MS08-044.mspx?pf=true</a> |
| id | SSV:3867 |
| last seen | 2017-11-19 |
| modified | 2008-08-19 |
| published | 2008-08-19 |
| reporter | Root |
| title | Microsoft Office畸形EPS/PICT过滤器远程代码执行漏洞（MS08-044） |
References
- http://marc.info/?l=bugtraq&m=121915960406986&w=2
- http://marc.info/?l=bugtraq&m=121915960406986&w=2
- http://marc.info/?l=bugtraq&m=121915960406986&w=2
- http://marc.info/?l=bugtraq&m=121915960406986&w=2
- http://secunia.com/advisories/31336
- http://secunia.com/advisories/31336
- http://www.securityfocus.com/bid/30595
- http://www.securityfocus.com/bid/30595
- http://www.securitytracker.com/id?1020673
- http://www.securitytracker.com/id?1020673
- http://www.us-cert.gov/cas/techalerts/TA08-225A.html
- http://www.us-cert.gov/cas/techalerts/TA08-225A.html
- http://www.vupen.com/english/advisories/2008/2348
- http://www.vupen.com/english/advisories/2008/2348
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-044
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-044
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6122
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6122