CVE-2008-0108
published 2008-02-12CVE-2008-0108: Stack-based buffer overflow in wkcvqd01.dll in Microsoft Works 6 File Converter, as used in Office 2003 SP2 and SP3, Works 8.0, and Works Suite 2005, allows…
PriorityP261critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
52.63%
99.0th percentile
Stack-based buffer overflow in wkcvqd01.dll in Microsoft Works 6 File Converter, as used in Office 2003 SP2 and SP3, Works 8.0, and Works Suite 2005, allows remote attackers to execute arbitrary code via a .wps file with crafted field lengths, aka "Microsoft Works File Converter Field Length Vulnerability."
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | office | — | — |
| microsoft | works | — | — |
| microsoft | works | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1 (OLE compound document magic bytes, WPS file header)
bytes↗
\x43\x48\x4e\x4b\x57\x4b\x53\x20 (CHNKWKS section marker in malicious WPS)
bytes↗
\x18\x00\x54\x45\x58\x54 (TEXT section header with oversized field length in malicious WPS)
- →Attack vector is a malicious .wps file delivered to a victim; initial access is via social engineering (email attachment or download). Alert on .wps files opened by Office or Works processes that subsequently spawn child processes. ↗
- ·Affected products include Office 2003 SP2 and SP3, Works 8.0, and Works Suite 2005 — detections should cover all these variants, not just one. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Microsoft Office 2003 - '.wps' Local Stack Overflow (MS08-011)
exploitdb·2008-02-13
CVE-2008-0108 Microsoft Office 2003 - '.wps' Local Stack Overflow (MS08-011)
Microsoft Office 2003 - '.wps' Local Stack Overflow (MS08-011)
---
/*
* Copyright (c) 2008 chujwamwdupe - pumpernikiel.c
*
* one day in teletubby land...
*
* an email from idefense:
*
* "Unfortunately, Microsoft has refused to credit you using the name you requested."
*
* ...what's wrong with 'chujwamwdupe', eh?
*
*
* Description:
* A vulnerability exists in WPS to RTF convert filter that is part
* of Microsoft Office 2003. It could be exploited by remote attacker
* to take complete control of an affected system. This issue is due to
* stack overflow error in function that read secions from WPS file.
* When we change size of for example TEXT section to number langer than
* 0x10, stack overflow occurs - very easy to exploit.
*
*
* Tested on:
* Microsoft Windows XP Service Pack 2 && Micros
Exploit-DB
Microsoft Works 8.0 - File Converter Field Length Remote Code Execution
exploitdb·2008-02-06
CVE-2008-0108 Microsoft Works 8.0 - File Converter Field Length Remote Code Execution
Microsoft Works 8.0 - File Converter Field Length Remote Code Execution
---
// source: https://www.securityfocus.com/bid/27659/info
Microsoft Works File Converter is prone to a remote code-execution vulnerability because it fails to adequately validate user-supplied input.
An attacker could exploit this issue by enticing a victim to open a malicious '.wps' file.
Successfully exploiting this issue would allow the attacker to execute arbitrary code in the context of the currently logged-in user.
/*
* Copyright (c) 2008 chujwamwdupe - pumpernikiel.c
*
* one day in teletubby land...
*
* an email from idefense:
*
* "Unfortunately, Microsoft has refused to credit you using the name
you requested."
*
* ...what's wrong with 'chujwamwdupe', eh?
*
*
* Description:
* A vulnerability exists in W
No writeups or analysis indexed.
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=660http://marc.info/?l=bugtraq&m=120361015026386&w=2http://secunia.com/advisories/28904http://www.securityfocus.com/bid/27659http://www.securitytracker.com/id?1019388http://www.us-cert.gov/cas/techalerts/TA08-043C.htmlhttp://www.vupen.com/english/advisories/2008/0513/referenceshttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-011https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5202https://www.exploit-db.com/exploits/5107http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=660http://marc.info/?l=bugtraq&m=120361015026386&w=2http://secunia.com/advisories/28904http://www.securityfocus.com/bid/27659http://www.securitytracker.com/id?1019388http://www.us-cert.gov/cas/techalerts/TA08-043C.htmlhttp://www.vupen.com/english/advisories/2008/0513/referenceshttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-011https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5202https://www.exploit-db.com/exploits/5107
2008-02-12
Published