CVE-2008-3007

Published: Sep 11, 2008Modified: Apr 23, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

Argument injection vulnerability in a URI handler in Microsoft Office XP SP3, 2003 SP2 and SP3, 2007 Office System Gold and SP1, and Office OneNote 2007 Gold and SP1 allow remote attackers to execute arbitrary code via a crafted onenote:// URL, aka "Uniform Resource Locator Validation Error Vulnerability."

Affected (7)

Products: Microsoft: Office, Office Onenote

2 products

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Microsoft Office	Version 2003 sp2
Microsoft Office	Version 2003 sp3
Microsoft Office	Version 2007
Microsoft Office	Version 2007 sp1
Microsoft Office	Version xp sp3
Microsoft Office Onenote	Version 2007 gold
Microsoft Office Onenote	Version 2007 sp1

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (18)

http://marc.info/?l=bugtraq&m=122235754013992&w=2

Source: secure@microsoft.com

http://www.insomniasec.com/advisories/ISVA-080910.1.htm

Source: secure@microsoft.com

http://www.securityfocus.com/archive/1/496178/100/0/threaded

Source: secure@microsoft.com

http://www.securityfocus.com/bid/31067

Source: secure@microsoft.com

http://www.securitytracker.com/id?1020833

Source: secure@microsoft.com

http://www.us-cert.gov/cas/techalerts/TA08-253A.html

Source: secure@microsoft.com

US Government Resource

http://www.vupen.com/english/advisories/2008/2523

Source: secure@microsoft.com

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-055

Source: secure@microsoft.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5970

Source: secure@microsoft.com

http://marc.info/?l=bugtraq&m=122235754013992&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.insomniasec.com/advisories/ISVA-080910.1.htm

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/496178/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/31067

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1020833

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.us-cert.gov/cas/techalerts/TA08-253A.html

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

http://www.vupen.com/english/advisories/2008/2523

Source: af854a3a-2127-422b-91ae-364da2661108

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-055

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5970

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.