CVE-2008-0081
published 2008-01-16CVE-2008-0081: Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, and Office 2004 for Mac allows user-assisted remote attackers to execute…
PriorityP276critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
57.91%
99.0th percentile
Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, and Office 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via crafted macros, aka "Macro Validation Vulnerability," a different vulnerability than CVE-2007-3490.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | excel | — | — |
| microsoft | excel | — | — |
| microsoft | excel | — | — |
| microsoft | excel_viewer | — | — |
| microsoft | office | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →A malicious macro embedded in a .doc file creates and executes a masquerading executable named Java.exe; monitor for Office processes spawning unexpected child processes, especially those masquerading as Java. ↗
- →The fake Java.exe process subsequently opens a backdoor and performs database reads/dumps; alert on Java.exe processes that exhibit database read activity without a legitimate Java-based SQL client context. ↗
- →Detect the attack chain: external network read → download of credential/cracking tool → execution of that tool, using temporal ordering of events. ↗
- →Monitor for anomalous child processes spawned by trusted parent processes (e.g., browser or Office) that are not part of the learned invariant set of normal child processes. ↗
- →Alert on sqlservr.exe sending unusually large amounts of data to outlier destination IPs, which may indicate database exfiltration following exploitation. ↗
- ·The CVE-2008-0081 exploit is delivered via crafted macros in Office documents; the malicious macro execution vector requires macro execution to be enabled in the target Office application. ↗
- ·The attack requires user interaction (user-assisted); the victim must open the malicious document attachment for the macro payload to trigger. ↗
- ·The malware masquerades as a legitimate Java runtime (Java.exe), making signature-based and simple whitelist-based detection unreliable without behavioral context. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vulncheck7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-h6j8-g36h-j99v: Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, and Office 2004 for Mac allows user-assisted remote attackers to
ghsa_unreviewed·2022-05-01·CVSS 7.5
CVE-2008-0081 [HIGH] CWE-908 GHSA-h6j8-g36h-j99v: Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, and Office 2004 for Mac allows user-assisted remote attackers to
Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, and Office 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via crafted macros, aka "Macro Validation Vulnerability," a different vulnerability than CVE-2007-3490.
VulnCheck
Microsoft Excel Use of Uninitialized Resource
vulncheck·2008·CVSS 7.5
CVE-2008-0081 [HIGH] Microsoft Excel Use of Uninitialized Resource
Microsoft Excel Use of Uninitialized Resource
Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, and Office 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via crafted macros, aka "Macro Validation Vulnerability," a different vulnerability than CVE-2007-3490.
Affected: Microsoft Excel
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-014
No detection rules found.
arXiv
Querying Streaming System Monitoring Data for Enterprise System Anomaly Detection
arxiv_fulltext·2020-02-27
Querying Streaming System Monitoring Data for Enterprise System Anomaly Detection
Querying Streaming System Monitoring Data for Enterprise System Anomaly Detection
Peng Gao^1\; Xusheng Xiao^2\; Ding Li^3\; Kangkook Jee^4\; Haifeng Chen^3\; Sanjeev R. Kulkarni^5\; Prateek Mittal^5
^1UC Berkeley\; ^2Case Western Reserve University\; ^3NEC Labs America\; ^4UT Dallas\; ^5Princeton University
[email protected]\; [email protected]\; \dingli,haifeng\@nec-labs.com\; [email protected]\; \kulkarni,pmittal\@princeton.edu
empty
empty
## Abstract
The need for countering Advanced Persistent Threat (APT) attacks
has led to the solutions that ubiquitously monitor system activities in each enterprise host, and perform timely abnormal system behavior detection over the stream of monitoring data.
However, existing stream-based solutions lack explicit language constr
arXiv
Heterogeneous Graph Matching Networks
arxiv_fulltext·2019-10-17
Heterogeneous Graph Matching Networks
## Abstract
Information systems have widely been the target of malware attacks. Traditional signature-based malicious program detection algorithms can only detect known malware and are prone to evasion techniques such as binary obfuscation, while behavior-based approaches highly rely on the malware training samples and incur prohibitively high training cost. To address the limitations of existing techniques, we propose ,an attentional heterogeneous Graph Neural Network based model to learn the distinguishable representations of program based on the invariant graph modeling of the program's execution behavior.
a heterogeneous Graph Matching Network model to learn the graph representation and similarity metric simultaneously based on the invariant graph modeling of the program's execution b
arXiv
SAQL: A Stream-based Query System for Real-Time Abnormal System Behavior Detection
arxiv_fulltext·2018-06-25
SAQL: A Stream-based Query System for Real-Time Abnormal System Behavior Detection
: A Stream-based Query System for Real-Time Abnormal System Behavior Detection
Peng Gao^1
Xusheng Xiao^2
Ding Li^3
Zhichun Li^3
Kangkook Jee^3
Zhenyu Wu^3
Chung Hwan Kim^3
Sanjeev R. Kulkarni^1
Prateek Mittal^1
^1Princeton University\; ^2Case Western Reserve University\; ^3NEC Laboratories America, Inc.
^1\pgao,kulkarni,pmittal\@princeton.edu\; ^[email protected]\; ^3\dingli,zhichun,kjee,adamwu,chungkim\@nec-labs.com
empty
empty
## Abstract
Recently, advanced cyber attacks, which consist of a sequence of steps that involve many vulnerabilities and hosts, compromise the security of many well-protected businesses.
This has led to the solutions that ubiquitously monitor system activities in each host (big data) as a series of events, and search for anomalies (abnormal behav
arXiv
AIQL: Enabling Efficient Attack Investigation from System Monitoring Data
arxiv_fulltext·2018-06-07
AIQL: Enabling Efficient Attack Investigation from System Monitoring Data
: Enabling Efficient Attack Investigation
from System Monitoring Data
Peng Gao^1
Xusheng Xiao^2
Zhichun Li^3
Kangkook Jee^3
Fengyuan Xu^4
Sanjeev R. Kulkarni^1
Prateek Mittal^1
^1Princeton University\; ^2Case Western Reserve University\; ^3NEC Laboratories America, Inc.
^4National Key Lab for Novel Software Technology, Nanjing University
^1\pgao,kulkarni,pmittal\@princeton.edu\; ^[email protected]\; ^3\zhichun,kjee\@nec-labs.com\; ^[email protected]
empty
empty
### Abstract
The need for countering Advanced Persistent Threat (APT) attacks has led to the solutions that ubiquitously monitor system activities in each host,
and perform timely attack investigation over the monitoring data for analyzing attack provenance.
However, existing query systems based on relational
CWE
Use of Uninitialized Variable
mitre_cwe
CWE-457 Use of Uninitialized Variable
CWE-457: Use of Uninitialized Variable
The code uses a variable that has not been initialized, leading to unpredictable or unintended results.
In some languages such as C and C++, stack variables are not initialized by default. They generally contain junk data with the contents of stack memory before the function was invoked. An attacker can sometimes control or read these contents. In other languages or conditions, a variable that is not explicitly initialized can be given a default value that has security implications, depending on the logic of the program. The presence of an uninitialized variable can sometimes indicate a typographic error in the code.
Modes of Introduction:
Phase: Implementation
Note: In C, using an uninitialized char * in some string libraries will return incorrect
CWE
Improper Initialization
mitre_cwe
CWE-665 Improper Initialization
CWE-665: Improper Initialization
The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
This can have security implications when the associated resource is expected to have certain properties or values, such as a variable that determines whether a user has been authenticated or not.
Modes of Introduction:
Phase: Implementation
Note: This weakness can occur in code paths that are not well-tested, such as rare error conditions. This is because the use of uninitialized data would be noticed as a bug during frequently-used functionality.
Phase: Operation
Common Consequences:
Scope: Confidentiality. Impact: Read Memory, Read Application Data. When reusing a resource such as memory or a program
CWE
Use of Uninitialized Resource
mitre_cwe
CWE-908 Use of Uninitialized Resource
CWE-908: Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
When a resource has not been properly initialized, the product may behave unexpectedly. This may lead to a crash or invalid memory access, but the consequences vary depending on the type of resource and how it is used within the product.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Confidentiality. Impact: Read Memory, Read Application Data. When reusing a resource such as memory or a program variable, the original contents of that resource may not be cleared before it is sent to an untrusted party.
Scope: Availability. Impact: DoS: Crash, Exit, or Restart. The uninitialized resource may contain values that cause program flow to change in ways that t
http://marc.info/?l=bugtraq&m=120585858807305&w=2http://secunia.com/advisories/28506http://securitytracker.com/id?1019200http://www.microsoft.com/technet/security/advisory/947563.mspxhttp://www.securityfocus.com/bid/27305http://www.us-cert.gov/cas/techalerts/TA08-071A.htmlhttp://www.vupen.com/english/advisories/2008/0146http://www.vupen.com/english/advisories/2008/0846/referenceshttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-014https://exchange.xforce.ibmcloud.com/vulnerabilities/39699https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5546http://marc.info/?l=bugtraq&m=120585858807305&w=2http://secunia.com/advisories/28506http://securitytracker.com/id?1019200http://www.microsoft.com/technet/security/advisory/947563.mspxhttp://www.securityfocus.com/bid/27305http://www.us-cert.gov/cas/techalerts/TA08-071A.htmlhttp://www.vupen.com/english/advisories/2008/0146http://www.vupen.com/english/advisories/2008/0846/referenceshttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-014https://exchange.xforce.ibmcloud.com/vulnerabilities/39699https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5546
2008-01-16
Published
Exploited in the wild