Vulnerabilities > CVE-2008-3020 - Resource Management Errors vulnerability in Microsoft Office, Office Converter Pack and Works

047910
CVSS 9.3 - CRITICAL
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
microsoft
CWE-399
critical
nessus
NVD
Published: 2008-08-12
Updated: 2018-10-12

Summary

Microsoft Office 2000 SP3 and XP SP3; Office Converter Pack; and Works 8 do not properly parse the length of a BMP file, which allows remote attackers to execute arbitrary code via a crafted BMP file, aka the "Malformed BMP Filter Vulnerability."

Vulnerable Configurations

Part Description Count
Application
Microsoft
5

Common Weakness Enumeration (CWE)

Nessus

NASL familyWindows : Microsoft Bulletins
NASL idSMB_NT_MS08-044.NASL
descriptionThe remote host is running a version of some Microsoft Office filters that are subject to various flaws that could allow arbitrary code to be run. An attacker may use these to execute arbitrary code on this host. To succeed, the attacker would have to send a rogue file to a user of the remote computer and have it import it with Microsoft Office.
last seen2020-06-01
modified2020-06-02
plugin id33873
published2008-08-13
reporterThis script is Copyright (C) 2008-2018 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/33873
titleMS08-044: Vulnerabilities in Microsoft Office Filters Could Allow Remote Code Execution (924090)

Oval

accepted2015-08-10T04:00:59.885-04:00
classvulnerability
contributors
  • nameDragos Prisaca
    organizationGideon Technologies, Inc.
  • nameAkihito Nakamura
    organizationAIST
  • nameDragos Prisaca
    organizationG2, Inc.
  • nameMaria Mikhno
    organizationALTX-SOFT
  • nameMaria Mikhno
    organizationALTX-SOFT
definition_extensions
  • commentMicrosoft Office 2000 is installed
    ovaloval:org.mitre.oval:def:93
  • commentMicrosoft Office XP is installed
    ovaloval:org.mitre.oval:def:663
  • commentMicrosoft Project 2002 SP1 is installed
    ovaloval:org.mitre.oval:def:707
  • commentMicrosoft Office Converter Pack is installed
    ovaloval:org.mitre.oval:def:28520
descriptionMicrosoft Office 2000 SP3 and XP SP3; Office Converter Pack; and Works 8 do not properly parse the length of a BMP file, which allows remote attackers to execute arbitrary code via a crafted BMP file, aka the "Malformed BMP Filter Vulnerability."
familywindows
idoval:org.mitre.oval:def:5868
statusaccepted
submitted2009-03-16T15:00:00
titleMicrosoft Malformed BMP Filter Vulnerability
version15

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 30599 CVE(CAN) ID: CVE-2008-3020 Microsoft Office是非常流行的办公软件套件。 Office的BMPIMP32.FLT过滤器模块没有正确处理office文档中的BMP图形，如果BMP图形文件头中指定了大量的颜色的话，则打开该文件就可能触发堆溢出，导致执行任意指令。 Microsoft Office XP SP3 Microsoft Office Converter Pack Microsoft Office 2000 SP3 Microsoft Works 8.0 临时解决方法： * 修改存取控制表以拒绝所有用户对BMP32.FLT的访问 注册表方法 对于Microsoft Windows 2000所有受支持的版本 1. 单击“开始”，单击“运行”，键入regedit.exe，然后单击“确定”。 2. 导航到HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Graphics Filters\Import\BMP 3. 单击“安全”，然后单击“权限”。 4. 记下此对话框中列出的权限，以便以后可以将其还原为初始值。 5. 取消选择“允许可继承的权限从父对象传送到此对象...”并单击“删除”和“确定”。 6. 对话框警告使用当前设置时，任何人都将无法访问此注册表项。出现提示时单 击“是”。 对于Windows XP Service Pack 1或更高版本操作系统的所有受支持版本 1. 单击“开始”，单击“运行”，键入regedit.exe，然后单击“确定”。 2. 导航到HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Graphics Filters\Import\BMP 3. 单击“编辑”，然后单击“权限”。 4. 记下此对话框中列出的权限，以便以后可以将其还原为初始值。 5. 单击“高级”。 6. 取消选择“允许父项的继承权限传播到该对象和所有子对象，包括那些在此明确定义的项目。单击“删除”，然后单击“确定”。 7. 对话框警告使用当前设置时，任何人都将无法访问此注册表项。单击“是”，然后单击“确定”关闭“BMP 的权限”对话框。 脚本方法 对于Windows XP的所有受支持的32位版本，通过命令提示符运行以下命令： cacls &quot;%ProgramFiles%\Common Files\Microsoft Shared\GRPHFLT\BMPIMP32.FLT&quot; /E /P everyone:N 对于Windows XP的所有受支持的基于x64的版本，通过命令提示符运行以下命令： cacls &quot;%ProgramFiles(x86)%\Common Files\Microsoft Shared\GRPHFLT\BMPIMP32.FLT&quot; /E /P everyone:N 对于Windows Vista和Windows Server 2008的所有受支持的32位版本，以管理员身份通过命令提示符运行下列命令： takeown /f &quot;%ProgramFiles%\Common Files\Microsoft Shared\GRPHFLT\BMPIMP32.FLT&quot; icacls &quot;%ProgramFiles%\Common Files\Microsoft Shared\GRPHFLT\BMPIMP32.FLT&quot; /save %TEMP%\BMP IMP32 _ACL.TXT icacls &quot;%ProgramFiles%\Common Files\Microsoft Shared\GRPHFLT\BMPIMP32.FLT&quot; /deny everyone:(F) 对于Windows Vista和Windows Server 2008的所有受支持的基于x64的版本，以管理员身份通过命令提示符运行下列命令： takeown /f &quot;%ProgramFiles(x86)%\Common Files\Microsoft Shared\GRPHFLT\BMPIMP32.FLT&quot; icacls &quot;%ProgramFiles(x86)%\Common Files\Microsoft Shared\GRPHFLT\BMPIMP32.FLT&quot; /save %TEMP%\BMP IMP32 _ACL.TXT icacls &quot;%ProgramFiles(x86)%\Common Files\Microsoft Shared\GRPHFLT\BMPIMP32.FLT&quot; /deny everyone:(F) * 不要打开或保存从不受信任来源或从受信任来源意外收到的文档。 厂商补丁： Microsoft --------- Microsoft已经为此发布了一个安全公告（MS08-044）以及相应补丁: MS08-044：Vulnerabilities in Microsoft Office Filters Could Allow Remote Code Execution (924090) 链接：<a href=http://www.microsoft.com/technet/security/bulletin/MS08-044.mspx?pf=true target=_blank>http://www.microsoft.com/technet/security/bulletin/MS08-044.mspx?pf=true</a>
idSSV:3848
last seen2017-11-19
modified2008-08-15
published2008-08-15
reporterRoot
titleMicrosoft Office BMP输入过滤器堆溢出漏洞（MS08-044）

References