Content

(MS08-043) Microsoft Excel Credential Caching Vulnerability (954066)

Type
Logic error
Impact of exploitation
Privilege Escalation
User Interaction
no user interaction is needed
Attack Vector
Malicious local network traffic
Rating
High
CVE reference
CVE-2008-3003 ,
Vendor Status
Responded and patched
Vulnerable systems
Office  2000 SP3,
Office  XP SP3,
Office  2003 SP2,
Office  2003 SP3,
Office System  2007,
Office System  2007 SP1,
Excel Viewer  2003,
Excel Viewer  ,
Excel Viewer  2003 SP3,
Office Compatibility Pack Word,Excel,Powerpoint  2007,
Summary
A vulnerability in Microsoft Excel may allow for remote privilege-escalation attacks.

Tab Navigation

Description

Excel is a spreadsheeting application developed by Microsoft. A vulnerability in Microsoft Excel may allow for remote privilege-escalation attacks. The vulnerability lies in Excel's connections to remote data sources. A remote attacker could access data in an XLSX file that has not been configured for remote access.

McAfee Product Mitigation & Recommendations

Recommendations

Download and install the patch available from Microsoft (954066): http://www.microsoft.com/technet/security/Bulletin/MS08-043.mspx

McAfee Product Mitigation

McAfee Foundstone

This Foundstone vulnerability check can be used to assess if your systems are vulnerable and is expected to accurately identify if a system is vulnerable in many enterprise environments.

Signature:
(MS08-043) Microsoft Excel Credential Caching Vulnerability (954066)
Signature identifier:
6046
Release date:
8/12/2008
McAfee Intrushield

This signature provides coverage for this vulnerability. McAfee Avert Labs will continue to update our coverage, as needed, as new exploit vectors are discovered and as new threats emerge.

Signature:
HTTP: Microsoft Excel Credential Caching Vulnerability
Signature identifier:
0x40251300
Release date:
8/12/2008
First released in:
Sigset(s) 3.1.69, 4.1.32

Additional Resources

Microsoft Security Bulletin: Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (954066)

http://www.microsoft.com/technet/security/Bulletin/MS08-043.mspx

All Information

Timeline -

8/12/2008

Vendor has provided a patch.

Description -

Excel is a spreadsheeting application developed by Microsoft. A vulnerability in Microsoft Excel may allow for remote privilege-escalation attacks. The vulnerability lies in Excel's connections to remote data sources. A remote attacker could access data in an XLSX file that has not been configured for remote access.

McAfee Product Mitigation & Recommendations

Recommendations -

Download and install the patch available from Microsoft (954066): http://www.microsoft.com/technet/security/Bulletin/MS08-043.mspx

McAfee Product Mitigation

McAfee Foundstone

This Foundstone vulnerability check can be used to assess if your systems are vulnerable and is expected to accurately identify if a system is vulnerable in many enterprise environments.

Signature:
(MS08-043) Microsoft Excel Credential Caching Vulnerability (954066)
Signature identifier:
6046
Release date:
8/12/2008
McAfee Intrushield

This signature provides coverage for this vulnerability. McAfee Avert Labs will continue to update our coverage, as needed, as new exploit vectors are discovered and as new threats emerge.

Signature:
HTTP: Microsoft Excel Credential Caching Vulnerability
Signature identifier:
0x40251300
Release date:
8/12/2008
First released in:
Sigset(s) 3.1.69, 4.1.32

Additional Resources

Additional Resources -

Microsoft Security Bulletin: Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (954066)

http://www.microsoft.com/technet/security/Bulletin/MS08-043.mspx