HTTP: Microsoft Word RTF Stylesheet Control Word Memory Corruption

This signature detects attempts to exploit a known memory corruption vulnerability in Microsoft Word products. It is due to an index error when processing RTF documents that contain more than six \stylesheet control words. A remote attacker can exploit this by enticing the target user to open a crafted RTF file. A successful attack, can lead to arbitrary code execution within the security context of the currently logged on user. In a successful code injection and execution attack, the behavior of the target depends on the intention of the attacker and is executed within the security context of the currently logged in user. In an unsuccessful code execution attack, the affected product terminates resulting in the loss of any unsaved data from the current session.

Extended Description

Microsoft Word is prone to a remote code-execution vulnerability. An attacker could exploit this issue by enticing a victim to open a malicious RTF file. Successfully exploiting this issue would allow the attacker to execute arbitrary code in the context of the currently logged-in user.

Affected Products

Microsoft word_2003

References

BugTraq: 32594

CVE: CVE-2008-4031

Short Name

HTTP:STC:DL:WORD-STYLESHEET-MEM

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Microsoft Word RTF Stylesheet Control Word Memory Corruption

Extended Description

Affected Products

References

Found a potential security threat?