Signature Detail

HTTP: Microsoft Word RTF File Handling Memory Corruption

This signature detects attempts to exploit a known heap overflow vulnerability in the way Microsoft Word and Microsoft Outlook process Rich Text Format (RTF) files. It is due to an integer overflow while parsing Control Words inside a malicious RTF file. A remote attacker can exploit this by enticing the target user to open a crafted RTF file or an RTF formatted e-mail using the affected applications, potentially causing arbitrary code to be injected and executed in the security context of the current user. In a successful attack, the behavior of the target depends on the intention of the attacker. In an unsuccessful code execution attack, the affected product terminates resulting in the loss of any unsaved data from the current session.

Extended Description

Microsoft Word is prone to a remote code-execution vulnerability. An attacker could exploit this issue by enticing a victim to open a malicious RTF file. Successfully exploiting this issue would allow the attacker to execute arbitrary code in the context of the currently logged-in user.

Affected Products

• Microsoft office_2003 SP1
• Microsoft office_2003 SP2
• Microsoft office_2003 SP3
• Microsoft office_2003
• Microsoft office_2004_for_mac
• Microsoft office_2007 SP1
• Microsoft office_2007
• Microsoft office_2008_for_mac
• Microsoft office_compatibility_pack_2007 SP1
• Microsoft office_compatibility_pack_2007
• Microsoft office_xp SP1
• Microsoft office_xp SP2
• Microsoft office_xp SP3
• Microsoft office_xp
• Microsoft outlook_2007
• Microsoft outlook_2007_sp1
• Microsoft word_2000 SP2
• Microsoft word_2000 SP3
• Microsoft word_2000 SR1
• Microsoft word_2000 Sr1a
• Microsoft word_2000
• Microsoft word_2002 SP1
• Microsoft word_2002 SP2
• Microsoft word_2002 SP3
• Microsoft word_2002
• Microsoft word_2003 SP1
• Microsoft word_2003 SP2
• Microsoft word_2003 SP3
• Microsoft word_2003
• Microsoft word_2007 SP1
• Microsoft word_2007
• Microsoft word_viewer_2003 SP3
• Microsoft word_viewer_2003

References

• BugTraq: 29104
• CVE: CVE-2008-1091