CVE-2008-0105

published 2008-02-12

CVE-2008-0105: Microsoft Works 6 File Converter, as used in Office 2003 SP2 and SP3, Works 8.0, and Works Suite 2005, allows remote attackers to execute arbitrary code via a…

Priority P2 58 critical 9.3 CVSS 2.0

AV N AC M Au N C C I C A C

EXPLOIT

Microsoft Works 6 File Converter, as used in Office 2003 SP2 and SP3, Works 8.0, and Works Suite 2005, allows remote attackers to execute arbitrary code via a .wps file with crafted section header index table information, aka "Microsoft Works File Converter Index Table Vulnerability."

Affected

3 ranges

Vendor	Product	Version range	Fixed in
microsoft	office	—	—
microsoft	works	—	—
microsoft	works	—	—

Detection & IOCs extracted from sources · hover to see the quote

filename evil.wps↗

bytes↗

43484e4b574b5320

bytes↗

18005445585400002f00

• → The malicious file uses the standard OLE2 Compound Document magic bytes (D0 CF 11 E0) with a crafted section header index table — scan for .wps files bearing this header combined with anomalous TEXT section size values (>0x10) in the CHNKWKS stream. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20