CVE-2008-3007 - Argument injection vulnerability in a URI handler in Microsoft Office XP SP3, 2003 SP2 and SP3, 2007 Office System Gold and SP1, and Office OneNote 2007 Gold and SP1 allow remote attackers to execute arbitrary code via a crafted onenote:// URL, aka "Uniform Resource Locator Validation Error Vulnerability."

Back Back to CVE browser

HIGH

Argument injection vulnerability in a URI handler in Microsoft Office XP SP3, 2003 SP2 and SP3, 2007 Office System Gold and SP1, and Office OneNote 2007 Gold and SP1 allow remote attackers to execute arbitrary code via a crafted onenote:// URL, aka "Uniform Resource Locator Validation Error Vulnerability."

Published Sep 10, 2008

9.3

HIGH

CVSS 2.0

EPSS 31.93%

Description

Argument injection vulnerability in a URI handler in Microsoft Office XP SP3, 2003 SP2 and SP3, 2007 Office System Gold and SP1, and Office OneNote 2007 Gold and SP1 allow remote attackers to execute arbitrary code via a crafted onenote:// URL, aka "Uniform Resource Locator Validation Error Vulnerability."

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-20

Improper Input Validation

References (9)

http://marc.info/?l=bugtraq&m=122235754013992&w=2
vendor-advisoryx_refsource_HP
http://www.insomniasec.com/advisories/ISVA-080910.1.htm
x_refsource_MISC
http://www.securityfocus.com/archive/1/496178/100/0/threaded
mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/31067
vdb-entryx_refsource_BID
http://www.securitytracker.com/id?1020833
vdb-entryx_refsource_SECTRACK
http://www.us-cert.gov/cas/techalerts/TA08-253A.html
third-party-advisoryx_refsource_CERTUS Government Resource
http://www.vupen.com/english/advisories/2008/2523
vdb-entryx_refsource_VUPEN
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-055
vendor-advisoryx_refsource_MS
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5970
vdb-entrysignaturex_refsource_OVAL

Link	Providers	Tags
http://marc.info/?l=bugtraq&m=122235754013992&w=2		vendor-advisoryx_refsource_HP
http://www.insomniasec.com/advisories/ISVA-080910.1.htm		x_refsource_MISC
http://www.securityfocus.com/archive/1/496178/100/0/threaded		mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/31067		vdb-entryx_refsource_BID
http://www.securitytracker.com/id?1020833		vdb-entryx_refsource_SECTRACK
http://www.us-cert.gov/cas/techalerts/TA08-253A.html		third-party-advisoryx_refsource_CERTUS Government Resource
http://www.vupen.com/english/advisories/2008/2523		vdb-entryx_refsource_VUPEN
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-055		vendor-advisoryx_refsource_MS
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5970		vdb-entrysignaturex_refsource_OVAL