Signature Detail

HTTP: Microsoft Office Works File Converter WPS File Field Length Stack Overflow

This signature detects attempts to exploit a known vulnerability in Microsoft Office. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the process' user.

Extended Description

Microsoft Works File Converter is prone to a remote code-execution vulnerability because it fails to adequately validate user-supplied input. An attacker could exploit this issue by enticing a victim to open a malicious '.wps' file. Successfully exploiting this issue would allow the attacker to execute arbitrary code in the context of the currently logged-in user.

Affected Products

• Microsoft Office 2003 SP2
• Microsoft Office 2003 SP3
• Microsoft Works 8.0
• Microsoft Works Suite 2005

References

• BugTraq: 27659
• CVE: CVE-2008-0105
• CVE: CVE-2008-0108