Vulnerabilities > CVE-2008-4027 - Resource Management Errors vulnerability in Microsoft products

047910
CVSS 9.3 - CRITICAL
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
microsoft
CWE-399
critical
nessus

Summary

Double free vulnerability in Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; and Office 2004 for Mac allow remote attackers to execute arbitrary code via a crafted (1) RTF file or (2) rich text e-mail message with multiple consecutive Drawing Object ("\do") tags, which triggers a "memory calculation error" and memory corruption, aka "Word RTF Object Parsing Vulnerability."

Common Weakness Enumeration (CWE)

Msbulletin

bulletin_idMS08-072
bulletin_url
date2008-12-09T00:00:00
impactRemote Code Execution
knowledgebase_id957173
knowledgebase_url
severityCritical
titleVulnerabilities in Microsoft Office Word Could Allow Remote Code Execution

Nessus

  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_MS_OFFICE_DEC2008.NASL
    descriptionThe remote Mac OS X host is running a version of Microsoft Office that is affected by several vulnerabilities. If an attacker can trick a user on the affected host into opening a specially crafted Excel or Word file, these issues could be leveraged to execute arbitrary code subject to the user
    last seen2019-10-28
    modified2010-10-20
    plugin id50060
    published2010-10-20
    reporterThis script is Copyright (C) 2010-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/50060
    titleMS08-072 / MS08-074: Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (957173 / 959070) (Mac OS X)
    code
    #TRUSTED 202f2408a0efc3a371e6c11331aac07d873827194cb48bcbb767ee48f63d8c1aa3c9b9a458aa388a366dea0c469c82858042d839eb6ca266a9b312e8b7149bd12f1010280ad6778a5eda5bc56a62a0dc0e2573a7fa7523be26ba0b2bdcc553ede848e636ae0f28318ce62b2890a63656766f50bb287c97840b51985921e5d528ef5ee2feb0e15b462f72b57bf95e5269f681a0de7ada335ad841898ef0842de3a0abd28114aabdfed0368d33d9329286bb3b280ab88ee95d3546ad5a4f61e505473e709bcb98792630e5ab9315789f27edcc2587bcb32638fff6f347a70a836e0ce403ba38b4d44c260809046f38777825df587a99ae0e00ebb8f3f39e1113961208d5ff862591b2ce28e6efe6442b683d1e157f54a2710cddf10d89277613e9a2b3fd891550e0d7d26ae67774de703dd211ab674a06c4bee3e26a1c24dd151ca613c01a3eb153c3ecf105c51547f14d617bf79132cfcdc0d819b1e295af087b8f4dd841ff0682255fc0b9cdca9839a8cfbaead64a64ad481a96dbcf1311d8266dbd51b334a16b9de02c20250300d9face727aa8a534eec1a3ee04e94347fa1ae1a5ed182ebbf093e191255bf1f7eb0bd78663852a74e55a174c1712323d8f6fc5821a2ec7e520239f661efb7ba495f17449e5b4fce6bd9ff1f92f9874e8656c919a078fa07457d7949e2a9ae8ceaa5dce65f1d5b4f706a2323d90f7cda1b16a
    #
    # (C) Tenable Network Security, Inc.
    #
    
    
    include("compat.inc");
    
    
    if (description)
    {
      script_id(50060);
      script_version("1.18");
      script_set_attribute(attribute:"plugin_modification_date", value:"2018/07/14");
    
      script_cve_id(
        "CVE-2008-4024",
        "CVE-2008-4025",
        "CVE-2008-4026",
        "CVE-2008-4027",
        "CVE-2008-4028",
        "CVE-2008-4031",
        "CVE-2008-4264",
        "CVE-2008-4266"
      );
      script_bugtraq_id(
        32579,
        32580,
        32581,
        32583,
        32585,
        32594,
        32621,
        32622
      );
      script_xref(name:"MSFT", value:"MS08-072");
      script_xref(name:"MSFT", value:"MS08-074");
      script_xref(name:"MSKB", value:"959070");
      script_xref(name:"MSKB", value:"957173");
      script_xref(name:"MSKB", value:"960401");
      script_xref(name:"MSKB", value:"960402");
      script_xref(name:"MSKB", value:"960403");
    
      script_name(english:"MS08-072 / MS08-074: Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (957173 / 959070) (Mac OS X)");
      script_summary(english:"Check version of Microsoft Office");
    
      script_set_attribute(attribute:"synopsis", value:
    "An application installed on the remote Mac OS X host is affected by
    multiple remote code execution vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote Mac OS X host is running a version of Microsoft Office that
    is affected by several vulnerabilities.
    
    If an attacker can trick a user on the affected host into opening a
    specially crafted Excel or Word file, these issues could be leveraged
    to execute arbitrary code subject to the user's privileges.");
      script_set_attribute(attribute:"see_also", value:"http://technet.microsoft.com/en-us/security/bulletin/ms08-072");
      script_set_attribute(attribute:"see_also", value:"http://technet.microsoft.com/en-us/security/bulletin/ms08-074");
      script_set_attribute(attribute:"solution", value:
    "Microsoft has released a set of patches for Office 2004 for Mac,
    Office 2008 for Mac, and Open XML File Format Converter for Mac.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_cwe_id(399);
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2008/12/09");
      script_set_attribute(attribute:"patch_publication_date", value:"2008/12/09");
      script_set_attribute(attribute:"plugin_publication_date", value:"2010/10/20");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office:2004::mac");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office:2008::mac");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:open_xml_file_format_converter:::mac");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"MacOS X Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2010-2018 Tenable Network Security, Inc.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/MacOSX/packages", "Host/uname");
    
      exit(0);
    }
    
    
    include("misc_func.inc");
    include("ssh_func.inc");
    include("macosx_func.inc");
    
    
    
    if(sshlib::get_support_level() >= sshlib::SSH_LIB_SUPPORTS_COMMANDS)
      enable_ssh_wrappers();
    else disable_ssh_wrappers();
    
    function exec(cmd)
    {
      local_var buf, ret;
    
      if (islocalhost())
        buf = pread(cmd:"/bin/bash", argv:make_list("bash", "-c", cmd));
      else
      {
        ret = ssh_open_connection();
        if (!ret) exit(1, "ssh_open_connection() failed.");
        buf = ssh_cmd(cmd:cmd);
        ssh_close_connection();
      }
      return buf;
    }
    
    
    packages = get_kb_item("Host/MacOSX/packages");
    if (!packages) exit(1, "The 'Host/MacOSX/packages' KB item is missing.");
    
    uname = get_kb_item("Host/uname");
    if (!uname) exit(1, "The 'Host/uname' KB item is missing.");
    if (!egrep(pattern:"Darwin.*", string:uname)) exit(1, "The host does not appear to be using the Darwin sub-system.");
    
    
    # Gather version info.
    info = '';
    installs = make_array();
    
    prod = 'Office 2008 for Mac';
    plist = "/Applications/Microsoft Office 2008/Office/MicrosoftComponentPlugin.framework/Versions/12/Resources/Info.plist";
    cmd =  'cat \'' + plist + '\' | ' +
      'grep -A 1 CFBundleShortVersionString | ' +
      'tail -n 1 | ' +
      'sed \'s/.*string>\\(.*\\)<\\/string>.*/\\1/g\'';
    version = exec(cmd:cmd);
    if (version && version =~ "^[0-9]+\.")
    {
      version = chomp(version);
      if (version !~ "^12\.") exit(1, "Failed to get the version for "+prod+" - '"+version+"'.");
    
      installs[prod] = version;
    
      ver = split(version, sep:'.', keep:FALSE);
      for (i=0; i<max_index(ver); i++)
        ver[i] = int(ver[i]);
    
      fixed_version = '12.1.5';
      fix = split(fixed_version, sep:'.', keep:FALSE);
      for (i=0; i<max_index(fix); i++)
        fix[i] = int(fix[i]);
    
      for (i=0; i<max_index(fix); i++)
        if ((ver[i] < fix[i]))
        {
          info +=
            '\n  Product           : ' + prod +
            '\n  Installed version : ' + version +
            '\n  Fixed version     : ' + fixed_version + '\n';
          break;
        }
        else if (ver[i] > fix[i])
          break;
    }
    
    prod = 'Office 2004 for Mac';
    cmd = GetCarbonVersionCmd(file:"Microsoft Component Plugin", path:"/Applications/Microsoft Office 2004/Office");
    version = exec(cmd:cmd);
    if (version && version =~ "^[0-9]+\.")
    {
      version = chomp(version);
      if (version !~ "^11\.") exit(1, "Failed to get the version for "+prod+" - '"+version+"'.");
    
      installs[prod] = version;
    
      ver = split(version, sep:'.', keep:FALSE);
      for (i=0; i<max_index(ver); i++)
        ver[i] = int(ver[i]);
    
      fixed_version = '11.5.3';
      fix = split(fixed_version, sep:'.', keep:FALSE);
      for (i=0; i<max_index(fix); i++)
        fix[i] = int(fix[i]);
    
      for (i=0; i<max_index(fix); i++)
        if ((ver[i] < fix[i]))
        {
          info +=
            '\n  Product           : ' + prod +
            '\n  Installed version : ' + version +
            '\n  Fixed version     : ' + fixed_version + '\n';
          break;
        }
        else if (ver[i] > fix[i])
          break;
    }
    
    prod = 'Open XML File Format Converter for Mac';
    plist = "/Applications/Open XML Converter.app/Contents/Info.plist";
    cmd =  'cat \'' + plist + '\' | ' +
      'grep -A 1 CFBundleShortVersionString | ' +
      'tail -n 1 | ' +
      'sed \'s/.*string>\\(.*\\)<\\/string>.*/\\1/g\'';
    version = exec(cmd:cmd);
    if (version && version =~ "^[0-9]+\.")
    {
      version = chomp(version);
      installs[prod] = version;
    
      ver = split(version, sep:'.', keep:FALSE);
      for (i=0; i<max_index(ver); i++)
        ver[i] = int(ver[i]);
    
      fixed_version = '1.0.2';
      fix = split(fixed_version, sep:'.', keep:FALSE);
      for (i=0; i<max_index(fix); i++)
        fix[i] = int(fix[i]);
    
      for (i=0; i<max_index(fix); i++)
        if ((ver[i] < fix[i]))
        {
          info +=
            '\n  Product           : ' + prod +
            '\n  Installed version : ' + version +
            '\n  Fixed version     : ' + fixed_version + '\n';
          break;
        }
        else if (ver[i] > fix[i])
          break;
    }
    
    
    # Report findings.
    if (info)
    {
      gs_opt = get_kb_item("global_settings/report_verbosity");
      if (gs_opt && gs_opt != 'Quiet') security_hole(port:0, extra:info);
      else security_hole(0);
    
      exit(0);
    }
    else
    {
      if (max_index(keys(installs)) == 0) exit(0, "Office for Mac / Open XML File Format Converter is not installed.");
      else
      {
        msg = 'The host has ';
        foreach prod (sort(keys(installs)))
          msg += prod + ' ' + installs[prod] + ' and ';
        msg = substr(msg, 0, strlen(msg)-1-strlen(' and '));
    
        msg += ' installed and thus is not affected.';
    
        exit(0, msg);
      }
    }
    
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS08-072.NASL
    descriptionThe remote host is running a version of Microsoft Word that may allow arbitrary code to be run on this host. To succeed, the attacker would have to send a rogue file to a user of the remote computer and have him open it. Then a bug in the word record parsing handler would result in code execution.
    last seen2020-06-01
    modified2020-06-02
    plugin id35071
    published2008-12-10
    reporterThis script is Copyright (C) 2008-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/35071
    titleMS08-072: Vulnerabilities in Microsoft Word Could Allow Remote Code Execution (957173)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
     script_id(35071);
     script_version("1.36");
     script_cvs_date("Date: 2018/11/15 20:50:30");
    
     script_cve_id(
       "CVE-2008-4024",
       "CVE-2008-4025",
       "CVE-2008-4026",
       "CVE-2008-4027",
       "CVE-2008-4030",
       "CVE-2008-4028",
       "CVE-2008-4031",
       "CVE-2008-4837"
     );
     script_bugtraq_id(
       32579,
       32580,
       32581,
       32583,
       32584,
       32585,
       32594,
       32642
     );
     script_xref(name:"MSFT", value:"MS08-072");
     script_xref(name:"MSKB", value:"956328");
     script_xref(name:"MSKB", value:"956329");
     script_xref(name:"MSKB", value:"956357");
     script_xref(name:"MSKB", value:"956358");
     script_xref(name:"MSKB", value:"956366");
    
     script_name(english:"MS08-072: Vulnerabilities in Microsoft Word Could Allow Remote Code Execution (957173)");
     script_summary(english:"Determines the version of WinWord.exe");
    
     script_set_attribute(attribute:"synopsis", value:
    "Arbitrary code can be executed on the remote host through Microsoft
    Word.");
     script_set_attribute(attribute:"description", value:
    "The remote host is running a version of Microsoft Word that may allow
    arbitrary code to be run on this host.
    
    To succeed, the attacker would have to send a rogue file to a user of
    the remote computer and have him open it.  Then a bug in the word record
    parsing handler would result in code execution.");
     script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2008/ms08-072");
     script_set_attribute(attribute:"solution", value:"Microsoft has released a set of patches for Word.");
     script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
     script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
     script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
     script_set_attribute(attribute:"exploit_available", value:"true");
     script_set_attribute(attribute:"exploited_by_malware", value:"true");
     script_cwe_id(94, 399);
    
     script_set_attribute(attribute:"vuln_publication_date", value:"2008/12/09");
     script_set_attribute(attribute:"patch_publication_date", value:"2008/12/09");
     script_set_attribute(attribute:"plugin_publication_date", value:"2008/12/10");
    
     script_set_attribute(attribute:"plugin_type", value:"local");
     script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office");
     script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:works");
     script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:word");
     script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:word_viewer");
     script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office_compatibility_pack");
     script_end_attributes();
    
     script_category(ACT_GATHER_INFO);
    
     script_copyright(english:"This script is Copyright (C) 2008-2018 Tenable Network Security, Inc.");
     script_family(english:"Windows : Microsoft Bulletins");
    
     script_dependencies("smb_nt_ms02-031.nasl", "office_installed.nasl", "ms_bulletin_checks_possible.nasl");
     script_require_keys("SMB/MS_Bulletin_Checks/Possible");
     script_require_ports(139, 445, 'Host/patch_management_checks');
    
     exit(0);
    }
    
    include("smb_hotfixes_fcheck.inc");
    include("smb_hotfixes.inc");
    include("misc_func.inc");
    include("audit.inc");
    
    get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
    
    bulletin = 'MS08-072';
    kbs = make_list("956328", "956329", "956357", "956358", "956366");
    if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
    
    port = get_kb_item("SMB/transport");
    
    
    
    #
    # Word
    #
    vuln = 0;
    list = get_kb_list("SMB/Office/Word/*/ProductPath");
    if (!isnull(list))
    {
      foreach item (keys(list))
      {
        v = item - 'SMB/Office/Word/' - '/ProductPath';
        if(ereg(pattern:"^9\..*", string:v))
        {
          # Word 2000 - fixed in 9.0.0.8974
          office_sp = get_kb_item("SMB/Office/2000/SP");
          if (!isnull(office_sp) && office_sp == 3)
          {
            sub =  ereg_replace(pattern:"^9\.00?\.00?\.([0-9]*)$", string:v, replace:"\1");
            if(sub != v && int(sub) < 8974 ) {
              vuln++;
              kb = '956328';
              hotfix_add_report(bulletin:bulletin, kb:kb);
            }
          }
        }
        else if(ereg(pattern:"^10\..*", string:v))
        {
          # Word XP - fixed in 10.0.6850.0
          office_sp = get_kb_item("SMB/Office/XP/SP");
          if (!isnull(office_sp) && office_sp == 3)
          {
            middle =  ereg_replace(pattern:"^10\.0\.([0-9]*)\.[0-9]*$", string:v, replace:"\1");
            if(middle != v && int(middle) < 6850 ) {
              vuln++;
              kb = '956329';
              hotfix_add_report(bulletin:bulletin, kb:kb);
            }
          }
        }
        else if(ereg(pattern:"^11\..*", string:v))
        {
          # Word 2003 - fixed in 11.0.8237.0 :
          office_sp = get_kb_item("SMB/Office/2003/SP");
          if (!isnull(office_sp) && office_sp == 3)
          {
            middle =  ereg_replace(pattern:"^11\.0\.([0-9]*)\.[0-9]*$", string:v, replace:"\1");
            if(middle != v && int(middle) < 8237 ) {
              vuln++;
              kb = '956357';
              hotfix_add_report(bulletin:bulletin, kb:kb);
            }
          }
        }
        else if(ereg(pattern:"^12\..*", string:v))
        {
          # Word 2007 - fixed in 12.0.6331.5000
          office_sp = get_kb_item("SMB/Office/2007/SP");
          if (!isnull(office_sp) && (office_sp == 0 || office_sp == 1))
          {
            middle =  ereg_replace(pattern:"^12\.0\.([0-9]*)\.[0-9]*$", string:v, replace:"\1");
            if(middle != v && int(middle) < 6331 ) {
              vuln++;
              kb = '956358';
              hotfix_add_report(bulletin:bulletin, kb:kb);
            }
          }
        }
      }
    }
    
    #
    # Word Viewer
    #
    list = get_kb_list("SMB/Office/WordViewer/*/ProductPath");
    if (!isnull(list))
    {
      foreach item (keys(list))
      {
        v = item - 'SMB/Office/WordViewer/' - '/ProductPath';
        if ( v && ereg(pattern:"^11\..*", string:v))
        {
          # Word Viewer 2003 - fixed in 11.0.8241.0
          middle =  ereg_replace(pattern:"^11\.0\.([0-9]*)\.[0-9]*$", string:v, replace:"\1");
          if(middle != v && int(middle) < 8241 ) {
            vuln++;
            kb = '956366';
            hotfix_add_report(bulletin:bulletin, kb:kb);
          }
        }
      }
    }
    if (vuln)
    {
      set_kb_item(name:"SMB/Missing/"+bulletin, value:TRUE);
      hotfix_security_hole();
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, 'affected');
    

Oval

accepted2014-06-30T04:11:14.895-04:00
classvulnerability
contributors
  • nameJeff Ito
    organizationSecure Elements, Inc.
  • nameSharath S
    organizationSecPod Technologies
  • namePradeep R B
    organizationSecPod Technologies
  • nameShane Shaffer
    organizationG2, Inc.
  • nameJosh Turpin
    organizationSymantec Corporation
  • nameSergey Artykhov
    organizationALTX-SOFT
  • nameMaria Mikhno
    organizationALTX-SOFT
definition_extensions
  • commentMicrosoft Word 2000 is installed
    ovaloval:org.mitre.oval:def:455
  • commentMicrosoft Word 2002 is installed
    ovaloval:org.mitre.oval:def:973
  • commentMicrosoft Word 2003 is installed
    ovaloval:org.mitre.oval:def:475
  • commentMicrosoft Word Viewer is installed
    ovaloval:org.mitre.oval:def:737
  • commentMicrosoft Word 2007 is installed
    ovaloval:org.mitre.oval:def:2074
  • commentMicrosoft Office Compatibility Pack is installed
    ovaloval:org.mitre.oval:def:1853
  • commentMicrosoft Outlook 2007 is installed
    ovaloval:org.mitre.oval:def:5352
descriptionDouble free vulnerability in Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; and Office 2004 for Mac allow remote attackers to execute arbitrary code via a crafted (1) RTF file or (2) rich text e-mail message with multiple consecutive Drawing Object ("\do") tags, which triggers a "memory calculation error" and memory corruption, aka "Word RTF Object Parsing Vulnerability."
familywindows
idoval:org.mitre.oval:def:6098
statusaccepted
submitted2008-12-09T13:52:00-05:00
titleWord RTF Object Parsing Vulnerability
version29