National Cyber Awareness System

Vulnerability Summary for CVE-2008-3477

Overview

Microsoft Excel 2000 SP3, 2002 SP3, and 2003 SP2 and SP3 does not properly validate data in the VBA Performance Cache when processing an Office document with an embedded object, which allows remote attackers to execute arbitrary code via an Excel file containing a crafted value, leading to heap-based buffer overflows, integer overflows, array index errors, and memory corruption, aka "Calendar Object Validation Vulnerability."

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Technical Alert: TA08-288A

Name: TA08-288A

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA08-288A.html

External Source: BID

Name: 31702

Type: Patch Information

Hyperlink:http://www.securityfocus.com/bid/31702

External Source: MS

Name: MS08-057

Type: Advisory; Patch Information

Hyperlink:http://www.microsoft.com/technet/security/Bulletin/MS08-057.mspx

External Source: SECUNIA

Name: 32211

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/32211

External Source: XF

Name: win-ms08kb956416-update(45581)

Hyperlink:http://xforce.iss.net/xforce/xfdb/45581

External Source: XF

Name: excel-calendar-code-execution(45566)

Hyperlink:http://xforce.iss.net/xforce/xfdb/45566

External Source: VUPEN

Name: ADV-2008-2808

Hyperlink:http://www.vupen.com/english/advisories/2008/2808

External Source: SECTRACK

Name: 1021044

Hyperlink:http://www.securitytracker.com/id?1021044

External Source: OVAL

Name: oval:org.mitre.oval:def:5870

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:5870

External Source: HP

Name: SSRT080143

Hyperlink:http://marc.info/?l=bugtraq&m=122479227205998&w=2

External Source: HP

Name: SSRT080143

Hyperlink:http://marc.info/?l=bugtraq&m=122479227205998&w=2

External Source: IDEFENSE

Name: 20081014 Microsoft Visual Basic for Applications - Multiple Vulnerabilities

Hyperlink:http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=746

References to Check Content

Identifier:oval:org.mitre.oval:def:5870

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:5870