National Cyber-Alert System

Vulnerability Summary for CVE-2008-4841

Overview

The WordPad Text Converter for Word 97 files in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted (1) .doc, (2) .wri, or (3) .rtf Word 97 file that triggers memory corruption, as exploited in the wild in December 2008. NOTE: As of 20081210, it is unclear whether this vulnerability is related to a WordPad issue disclosed on 20080925 with a 2008-crash.doc.rar example, but there are insufficient details to be sure.

Description

http://www.microsoft.com/technet/security/advisory/960906.mspx Microsoft Security Advisory (960906) Vulnerability in WordPad Text Converter Could Allow Remote Code Execution Published: December 9, 2008 Microsoft is investigating new reports of a vulnerability in the WordPad Text Converter for Word 97 files on Windows 2000 Service Pack 4, Windows XP Service Pack 2, Windows Server 2003 Service Pack 1, and Windows Server 2003 Service Pack 2. Windows XP Service Pack 3, Windows Vista, and Windows Server 2008 are not affected as these operating systems do not contain the vulnerable code. Upon completion of this investigation, Microsoft will take the appropriate action to protect our customers, which may include providing a solution through a service pack, our monthly security update release process, or an out-of-cycle security update, depending on customer needs. At this time, we are aware only of limited and targeted attacks that attempt to use this vulnerability. Additionally, as the issue has not been publicly disclosed broadly, we believe the risk at this time to be limited. We continue to encourage responsible disclosure of vulnerabilities. We believe the commonly accepted practice of reporting vulnerabilities directly to a vendor serves everyone's best interests. This practice helps to ensure that customers receive comprehensive, high-quality updates for security vulnerabilities without exposure to malicious attackers while the update is being developed. Customers who believe that they have been attacked can obtain security support at Get security support and should contact the national law enforcement agency in their country. Customers in the United States can contact Customer Service and Support at no charge using the PC Safety hotline at 1-866-PCSAFETY. Additionally, customers in the United States should contact their local FBI office or report their situation at Internet Crime Complaint Center. Microsoft continues to encourage customers to follow the "Protect Your Computer" guidance of enabling a firewall, applying all software updates and installing anti-virus and anti-spyware software. Additional information can be found at Security at home. Mitigating Factors: • This issue does not affect Windows XP Service Pack 3, Windows Vista, and Windows Server 2008. • An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less affected than users who operate with administrative user rights. • The vulnerability cannot be exploited automatically through e-mail. For an attack to be successful, a user must open an attachment that is sent in an e-mail message. • When Microsoft Office Word is installed, Word 97 documents are by default opened using Microsoft Office Word, which is not affected by this vulnerability. However, an attacker could rename a malicious file to have a Windows Write (.wri) extension, which would still invoke WordPad. This file type can be blocked at the Internet perimeter.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Technical Alert: TA09-104A

Name: TA09-104A

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA09-104A.html

External Source: VUPEN

Name: ADV-2009-1024

Hyperlink:http://www.vupen.com/english/advisories/2009/1024

External Source: BID

Name: 32718

Hyperlink:http://www.securityfocus.com/bid/32718

External Source: BID

Name: 31399

Hyperlink:http://www.securityfocus.com/bid/31399

External Source: MILW0RM

Name: 6560

Hyperlink:http://www.milw0rm.com/exploits/6560

External Source: MS

Name: MS09-010

Hyperlink:http://www.microsoft.com/technet/security/bulletin/ms09-010.mspx

External Source: CONFIRM

Name: http://www.microsoft.com/technet/security/advisory/960906.mspx

Type: Advisory

Hyperlink:http://www.microsoft.com/technet/security/advisory/960906.mspx

External Source: VUPEN

Name: ADV-2008-3390

Hyperlink:http://www.frsirt.com/english/advisories/2008/3390

External Source: SECTRACK

Name: 1021376

Hyperlink:http://securitytracker.com/id?1021376

External Source: SREASON

Name: 4711

Hyperlink:http://securityreason.com/securityalert/4711

External Source: SECUNIA

Name: 32997

Type: Advisory

Hyperlink:http://secunia.com/advisories/32997

External Source: MISC

Name: http://milw0rm.com/sploits/2008-crash.doc.rar

Hyperlink:http://milw0rm.com/sploits/2008-crash.doc.rar