Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2008-3007 | First vendor Publication | 2008-09-10 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 9.3 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Argument injection vulnerability in a URI handler in Microsoft Office XP SP3, 2003 SP2 and SP3, 2007 Office System Gold and SP1, and Office OneNote 2007 Gold and SP1 allow remote attackers to execute arbitrary code via a crafted onenote:// URL, aka "Uniform Resource Locator Validation Error Vulnerability." |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3007 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-20 | Improper Input Validation |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:5970 | |||
| Oval ID: | oval:org.mitre.oval:def:5970 | ||
| Title: | Uniform Resource Locator Validation Error Vulnerability | ||
| Description: | Argument injection vulnerability in a URI handler in Microsoft Office XP SP3, 2003 SP2 and SP3, 2007 Office System Gold and SP1, and Office OneNote 2007 Gold and SP1 allow remote attackers to execute arbitrary code via a crafted onenote:// URL, aka "Uniform Resource Locator Validation Error Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2008-3007 | Version: | 6 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows Server 2008 | Product(s): | Microsoft Office XP Microsoft Office 2003 Microsoft Office 2007 Microsoft Office 2007 Compatibility Pack Microsoft OneNote 2007 |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 5 | |
| Application | 2 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2008-09-10 | Name : Microsoft Office Remote Code Execution Vulnerabilities (955047) File : nvt/secpod_ms08-055_900046.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 47964 | Microsoft Office OneNote Protocol Handler (onenote://) URI Handling Arbitrary... |
Information Assurance Vulnerability Management (IAVM)
| Date | Description |
|---|---|
| 2008-09-11 | IAVM : 2008-B-0058 - Microsoft Office Remote Code Execution Vulnerability Severity : Category II - VMSKEY : V0017345 |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2014-01-10 | Microsoft Office OneNote iframe caller exploit attempt RuleID : 14262 - Revision : 16 - Type : FILE-OFFICE |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2008-09-10 | Name : Arbitrary code can be executed on the remote host through Microsoft Office. File : smb_nt_ms08-055.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:13:34 |
|
| 2024-11-28 12:15:56 |
|
| 2021-05-04 12:07:41 |
|
| 2021-04-22 01:08:04 |
|
| 2020-05-23 00:21:55 |
|
| 2018-10-13 00:22:42 |
|
| 2018-10-12 00:20:23 |
|
| 2017-09-29 09:23:37 |
|
| 2016-04-26 17:36:10 |
|
| 2014-02-17 10:45:35 |
|
| 2014-01-19 21:25:05 |
|
| 2013-11-11 12:37:58 |
|
| 2013-05-11 00:20:48 |
|
