Launch Printer Friendly Page Security TechCenter > > Microsoft Security Bulletin MS08-016

Microsoft Security Bulletin MS08-016 - Critical

Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (949030)

Published: | Updated:

Version: 2.1

General Information

Executive Summary

This security update resolves two privately reported vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a malformed Office file. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

This security update is rated Critical for supported editions of Microsoft Office 2000 and rated Important for supported editions of Microsoft Office XP, Microsoft Office 2003 Service Pack 2, Microsoft Office Excel Viewer 2003 and Microsoft Office Excel Viewer 2003 Service Pack 3, Microsoft Office Word Viewer 2003 and Microsoft Office Word Viewer 2003 Service Pack 3, and Microsoft Office 2004 for Mac. For more information, see the subsection, Affected and Non-Affected Software, in this section.

This security update addresses these vulnerabilities by modifying the way that Microsoft Office allocates memory. For more information about the vulnerability, see the Frequently Asked Questions (FAQ) subsection for the specific vulnerability entry under the next section, Vulnerability Information.

Recommendation. Microsoft recommends that customers apply the update immediately

Known Issues. None

Affected and Non-Affected Software

The following software have been tested to determine which versions or editions are affected. Other versions or editions are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, visit Microsoft Support Lifecycle.

Affected Software

Office Suite and Other SoftwareMaximum Security ImpactAggregate Severity RatingBulletins Replaced by this Update
Microsoft Office 2000 Service Pack 3
(KB947361)
Remote Code ExecutionCriticalMS07-025
Microsoft Office XP Service Pack 3
(KB947866)
Remote Code ExecutionImportantMS07-025
Microsoft Office 2003 Service Pack 2
(KB947355)
Remote Code ExecutionImportantMS07-025
Microsoft Office Excel Viewer 2003
(KB947355)
Microsoft Office Excel Viewer 2003 Service Pack 3
(KB947355)
Remote Code ExecutionImportantNone
Microsoft Office Word Viewer 2003
(KB947355)
Microsoft Office Word Viewer 2003 Service Pack 3
(KB947355)
Remote Code ExecutionImportantNone
Microsoft Office 2004 for Mac
(KB949357)
Remote Code ExecutionImportantMS08-013

Non-Affected Software

Office Suite and Other Software
Microsoft Office 2003 Service Pack 3
Microsoft PowerPoint Viewer 2003
Microsoft Visio 2002 Service Pack 2
Microsoft Visio 2003 Viewer
Microsoft Project 2000 Service Pack 1
Microsoft Project 2002 Service Pack 2
2007 Microsoft Office System
2007 Microsoft Office System Service Pack 1
Microsoft Office 2008 for Mac

Frequently Asked Questions (FAQ) Related to This Security Update

Vulnerability Information

Severity Ratings and Vulnerability Identifiers

Microsoft Office Cell Parsing Memory Corruption Vulnerability - CVE-2008-0113

Microsoft Office Memory Corruption Vulnerability - CVE-2008-0118

Update Information

Detection and Deployment Tools and Guidance

Security Update Deployment

Other Information

Acknowledgments

Microsoft thanks the following for working with us to help protect customers:

  • Arnaud Dovi, working with Zero Day Initiative, for reporting the Microsoft Office Cell Parsing Vulnerability (CVE-2008-0113)
  • An anonymous finder for reporting the Microsoft Office Memory Corruption Vulnerability (CVE-208-0118)

Support

  • Customers in the U.S. and Canada can receive technical support from Microsoft Product Support Services at 1-866-PCSAFETY. There is no charge for support calls that are associated with security updates.
  • International customers can receive support from their local Microsoft subsidiaries. There is no charge for support that is associated with security updates. For more information about how to contact Microsoft for support issues, visit the International Support Web site.

Disclaimer

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions

  • V1.0 (March 11, 2008): Bulletin published.
  • V1.1 (March 12, 2008): Bulletin updated. FAQ added to clarify the reason why a non-vulnerable version of Office will be offered this update. Also removed MS07-015 as a replaced bulletin for Microsoft Office XP Service Pack 3.
  • V1.2 (March 26, 2008): Bulletin updated. Added MS07-025 as a replaced bulletin for Microsoft Office 2003 Service Pack 2.
  • V2.0 (April 16, 2008): Bulletin updated. Added Microsoft Office Word Viewer 2003 and Microsoft Office Word Viewer 2003 Service Pack 3 as affected software.
  • V2.1 (April 30, 2008): Bulletin updated. Added a new entry to the Update FAQ describing additional security features included in the update for Microsoft Office 2003 Service Pack 2.