Launch Printer Friendly Page Security TechCenter > > Microsoft Security Bulletin MS08-008

Microsoft Security Bulletin MS08-008 - Critical

Vulnerability in OLE Automation Could Allow Remote Code Execution (947890)

Published: | Updated:

Version: 1.2

General Information

Executive Summary

This critical security update resolves a privately reported vulnerability. This vulnerability could allow remote code execution if a user viewed a specially crafted Web page. The vulnerability could be exploited through attacks on Object Linking and Embedding (OLE) Automation. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

This is a critical security update for all supported editions of Microsoft Windows 2000, Windows XP, Windows Vista, Microsoft Office 2004 for Mac, and Visual Basic 6. For other affected editions of Windows, this update is rated moderate. For more information, see the subsection, Affected and Non-Affected Software, in this section.

This security update addresses the vulnerability by adding a check on memory requests within OLE Automation. For more information about the vulnerability, see the Frequently Asked Questions (FAQ) subsection for the specific vulnerability entry under the next section, Vulnerability Information.

Recommendation. Microsoft recommends that customers apply the update immediately.

Known Issues. None.

Affected and Non-Affected Software

The following software have been tested to determine which versions or editions are affected. Other versions or editions are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, visit Microsoft Support Lifecycle.

Affected Software

SoftwareMaximum Security ImpactAggregate Severity RatingBulletins Replaced by This Update
Windows 2000 Service Pack 4
(KB943055)
Remote Code ExecutionCriticalMS07-043
Windows XP Service Pack 2
(KB943055)
Remote Code ExecutionCriticalMS07-043
Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2
(KB943055)
Remote Code ExecutionCriticalMS07-043
Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2
(KB943055)
Remote Code ExecutionModerateMS07-043
Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2
(KB943055)
Remote Code ExecutionModerateMS07-043
Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems
(KB943055)
Remote Code ExecutionModerateMS07-043
Windows Vista
(KB943055)
Remote Code ExecutionCriticalNone
Windows Vista x64 Edition
(KB943055)
Remote Code ExecutionCriticalNone
Microsoft Office 2004 for Mac
(KB948056)
Remote Code ExecutionCriticalNone
Microsoft Visual Basic 6.0 Service Pack 6
(KB946235)
Remote Code ExecutionCriticalMS07-043

Non-Affected Software

Operating System
Windows Vista Service Pack 1 (all editions)
Windows Server 2008 (all editions)
Microsoft Office 2008 for Mac

Frequently Asked Questions (FAQ) Related to This Security Update

Vulnerability Information

Severity Ratings and Vulnerability Identifiers

OLE Heap Overrun Vulnerability - CVE-2007-0065

Update Information

Detection and Deployment Tools and Guidance

Security Update Information

Other Information

Acknowledgments

Microsoft thanks the following for working with us to help protect customers:

  • Ryan Smith and Alex Wheeler of IBM ISS X-Force for reporting the OLE Heap Overrun Vulnerability (CVE-2007-0065).

Support

  • Customers in the U.S. and Canada can receive technical support from Microsoft Product Support Services at 1-866-PCSAFETY. There is no charge for support calls that are associated with security updates.
  • International customers can receive support from their local Microsoft subsidiaries. There is no charge for support that is associated with security updates. For more information about how to contact Microsoft for support issues, visit the International Support Web site.

Disclaimer

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions

  • V1.0 (February 12, 2008): Bulletin published.
  • V1.1 (February 13, 2008): Bulletin updated: The security update for Visual Basic 6.0 Service Pack 6 (KB946235) now lists MS07-043 as a previous Bulletin that this update replaces.
  • V1.2 (February 20, 2008): Bulletin updated: Corrected the file timestamps for the security update for all supported 32-bit editions of Windows XP.