CVE-2008-4841

Published: Dec 10, 2008Modified: Apr 23, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

The WordPad Text Converter for Word 97 files in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted (1) .doc, (2) .wri, or (3) .rtf Word 97 file that triggers memory corruption, as exploited in the wild in December 2008. NOTE: As of 20081210, it is unclear whether this vulnerability is related to a WordPad issue disclosed on 20080925 with a 2008-crash.doc.rar example, but there are insufficient details to be sure.

Affected (2)

Products: Microsoft: Wordpad

1 product

Configuration A

2 vulnerable · 4 platform

Vulnerable Software	Affected Versions
Microsoft Wordpad	All versions
Microsoft Wordpad	Version unknown

Running on/with	Platform Versions
Microsoft Windows 2000	All versions
Microsoft Windows Server 2003	All versions
Microsoft Windows Server 2003	All versions
Microsoft Windows Xp	All versions

Related CWEs

References (26)

http://milw0rm.com/sploits/2008-crash.doc.rar

Source: secure@microsoft.com

Exploit

http://secunia.com/advisories/32997

Source: secure@microsoft.com

Vendor Advisory

http://securityreason.com/securityalert/4711

Source: secure@microsoft.com

http://securitytracker.com/id?1021376

Source: secure@microsoft.com

http://www.microsoft.com/technet/security/advisory/960906.mspx

Source: secure@microsoft.com

Vendor Advisory

http://www.securityfocus.com/bid/31399

Source: secure@microsoft.com

http://www.securityfocus.com/bid/32718

Source: secure@microsoft.com

http://www.us-cert.gov/cas/techalerts/TA09-104A.html

Source: secure@microsoft.com

US Government Resource

http://www.vupen.com/english/advisories/2008/3390

Source: secure@microsoft.com

http://www.vupen.com/english/advisories/2009/1024

Source: secure@microsoft.com

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-010

Source: secure@microsoft.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6050

Source: secure@microsoft.com

https://www.exploit-db.com/exploits/6560

Source: secure@microsoft.com

http://milw0rm.com/sploits/2008-crash.doc.rar

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://secunia.com/advisories/32997

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://securityreason.com/securityalert/4711

Source: af854a3a-2127-422b-91ae-364da2661108

http://securitytracker.com/id?1021376

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.microsoft.com/technet/security/advisory/960906.mspx

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.securityfocus.com/bid/31399

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/32718

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.us-cert.gov/cas/techalerts/TA09-104A.html

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

http://www.vupen.com/english/advisories/2008/3390

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2009/1024

Source: af854a3a-2127-422b-91ae-364da2661108

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-010

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6050

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.exploit-db.com/exploits/6560

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.