[NT] Vulnerabilities in Microsoft Excel Allows Code Execution (MS08-057)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Vulnerabilities in Microsoft Excel Allows Code Execution (MS08-057)
------------------------------------------------------------------------


SUMMARY

This security update resolves three privately reported vulnerabilities in
Microsoft Office Excel that could allow remote code execution if a user
opens a specially crafted Excel file. An attacker who successfully
exploited these vulnerabilities could take complete control of an affected
system. An attacker could then install programs; view, change, or delete
data; or create new accounts with full user rights. Users whose accounts
are configured to have fewer user rights on the system could be less
impacted than users who operate with administrative user rights.

This security update is rated Critical for all supported editions of
Microsoft Office Excel 2000 and rated Important for all supported editions
of Microsoft Office Excel 2002, Microsoft Office Excel 2003, Microsoft
Office Excel Viewer 2003, Microsoft Office Excel 2007, Microsoft Office
Compatibility Pack , Microsoft Office Excel Viewer, and Microsoft Office
SharePoint Server 2007. For more information, see the subsection, Affected
and Non-Affected Software, in this section.

DETAILS

Affected Software:
* Microsoft Office 2000 Service Pack 3 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=1b2740e0-ecdd-48ca-84e0-eb187c31eb16> Excel 2000 Service Pack 3 (KB955461) - Remote Code Execution - Critical - MS08-043
* Microsoft Office XP Service Pack 3 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=27cedef1-c47c-472c-a343-cd9b4ebc2bba> Excel 2002 Service Pack 3 (KB955464) - Remote Code Execution - Important - MS08-043
* Microsoft Office 2003 Service Pack 2 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=4df27e8a-d803-483b-a700-0177d71bf368> Excel 2003 Service Pack 2 (KB955466) - Remote Code Execution - Important - MS08-043
* Microsoft Office 2003 Service Pack 3 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=4df27e8a-d803-483b-a700-0177d71bf368> Excel 2003 Service Pack 3 (KB955466) - Remote Code Execution - Important - MS08-043
* 2007 Microsoft Office System -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=2765bbc0-ea2e-4b6e-822c-222ee8e5021f> Excel 2007 (KB955470) - Remote Code Execution - Important - MS08-043
* 2007 Microsoft Office System Service Pack 1 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=2765bbc0-ea2e-4b6e-822c-222ee8e5021f> Excel 2007 Service Pack 1 (KB955470) - Remote Code Execution - Important - MS08-043
*
<http://www.microsoft.com/downloads/details.aspx?FamilyId=9769ce08-5207-4c63-b7b9-536266ad6b2b> Microsoft Office Excel Viewer 2003 (KB955468) - Remote Code Execution - Important - MS08-043
*
<http://www.microsoft.com/downloads/details.aspx?FamilyId=9769ce08-5207-4c63-b7b9-536266ad6b2b> Microsoft Office Excel Viewer 2003 Service Pack 3 (KB955468) - Remote Code Execution - Important - MS08-043
*
<http://www.microsoft.com/downloads/details.aspx?FamilyId=83c88444-75b8-44d1-b280-3671394ade45> Microsoft Office Excel Viewer (KB955935) - Remote Code Execution - Important - MS08-043
*
<http://www.microsoft.com/downloads/details.aspx?FamilyId=9a7be004-5903-4101-90c5-c0d5f8722af9> Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats (KB955936) - Remote Code Execution - Important - MS08-043
*
<http://www.microsoft.com/downloads/details.aspx?FamilyId=9a7be004-5903-4101-90c5-c0d5f8722af9> Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 1 (KB955936) - Remote Code Execution - Important - MS08-043
*
<http://www.microsoft.com/downloads/details.aspx?FamilyId=5c29e646-504c-4455-9d35-9a1bed6d7535> Microsoft Office SharePoint Server 2007* (KB955937) - Remote Code Execution - Important - MS08-043
*
<http://www.microsoft.com/downloads/details.aspx?FamilyId=5c29e646-504c-4455-9d35-9a1bed6d7535> Microsoft Office SharePoint Server 2007 Service Pack 1* (KB955937) - Remote Code Execution - Important - MS08-043
*
<http://www.microsoft.com/downloads/details.aspx?FamilyId=3c21c405-2c9e-45d0-be4d-8ccd093af31f> Microsoft Office SharePoint Server 2007 x64 Edition* (KB955937) - Remote Code Execution - Important - MS08-043
*
<http://www.microsoft.com/downloads/details.aspx?FamilyId=3c21c405-2c9e-45d0-be4d-8ccd093af31f> Microsoft Office SharePoint Server 2007 x64 Edition Service Pack 1* (KB955937) - Remote Code Execution - Important - MS08-043
*
<http://www.microsoft.com/downloads/details.aspx?FamilyId=BA4FA21A-7E01-4EF8-9B9F-9D51D00EF094> Microsoft Office 2004 for Mac (KB958312) - Remote Code Execution - Important - MS08-043
*
<http://www.microsoft.com/downloads/details.aspx?FamilyId=E70C5AE0-2858-46DE-81F8-DCD1786656B7> Microsoft Office 2008 for Mac (KB958267) - Remote Code Execution - Important - MS08-043
*
<http://www.microsoft.com/downloads/details.aspx?FamilyId=2A8D9A3B-B8A4-43B6-82A6-A2E7D16AE11D> Open XML File Format Converter for Mac (KB958304) - Remote Code Execution - Important - None

*This update applies to servers that have Excel Services installed, such
as the default configuration of Microsoft Office SharePoint Server 2007
Enterprise and Microsoft Office SharePoint Server 2007 For Internet Sites.
Microsoft Office SharePoint Server 2007 Standard does not include Excel
Services.

Non-Affected Software:
* Microsoft Works 8.0
* Microsoft Works 8.5
* Microsoft Works 9.0
* Microsoft Works Suite 2005
* Microsoft Works Suite 2006
* Microsoft Office SharePoint Server 2003 Service Pack 3

Calendar Object Validation Vulnerability - CVE-2008-3477
A remote code execution vulnerability exists in the way Excel processes a
VBA Performance Cache. The vulnerability could allow remote code execution
if a user opens a specially crafted Excel file in a VBA Performance Cache.
An attacker who successfully exploited this vulnerability could take
complete control of an affected system. An attacker could then install
programs; view, change, or delete data; or create new accounts with full
user rights.

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3477>
CVE-2008-3477

File Format Parsing Vulnerability - CVE-2008-3471
A remote code execution vulnerability exists in Microsoft Excel as a
result of improper memory allocation when loading Excel objects. The
vulnerability could allow remote code execution if a user opens a
specially crafted Excel file that includes a malformed object. An attacker
who successfully exploited this vulnerability could take complete control
of an affected system. An attacker could then install programs; view,
change, or delete data; or create new accounts with full user rights.

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3471>
CVE-2008-3471

Formula Parsing Vulnerability - CVE-2008-4019
The specific flaw exists when parsing Microsoft Excel documents containing
a specially crafted formula embedded inside a cell. This can result in a
remote compromise of the system under the context of the currently logged
in user.

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4019>
CVE-2008-4019


ADDITIONAL INFORMATION

The information has been provided by Microsoft Product Security.
The original article can be found at:
<http://www.microsoft.com/technet/security/bulletin/ms08-057.mspx>
http://www.microsoft.com/technet/security/bulletin/ms08-057.mspx



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages