Vulnerability Details : CVE-2008-0320
Public exploit exists!
Heap-based buffer overflow in the OLE importer in OpenOffice.org before 2.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an OLE file with a crafted DocumentSummaryInformation stream.
Vulnerability category: OverflowExecute codeDenial of service
Products affected by CVE-2008-0320
- cpe:2.3:a:openoffice:openoffice.org:*:*:*:*:*:*:*:*
- cpe:2.3:a:openoffice:openoffice.org:2.1:*:*:*:*:*:*:*
- cpe:2.3:a:openoffice:openoffice.org:2.2:*:*:*:*:*:*:*
- cpe:2.3:a:openoffice:openoffice.org:2.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:openoffice:openoffice.org:2.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:openoffice:openoffice.org:2.3:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2008-0320
85.38%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 99 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2008-0320
-
OpenOffice OLE Importer DocumentSummaryInformation Stream Handling Overflow
Disclosure Date: 2008-04-17First seen: 2020-04-26exploit/windows/fileformat/openoffice_oleThis module exploits a vulnerability in OpenOffice 2.3.1 and 2.3.0 on Microsoft Windows XP SP3. By supplying a OLE file with a malformed DocumentSummaryInformation stream, an attacker can gain control of the execution flow, which results arbitrary code exe
CVSS scores for CVE-2008-0320
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
NIST |
CWE ids for CVE-2008-0320
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2008-0320
-
http://www.vupen.com/english/advisories/2008/1253/references
Vendor Advisory
-
http://www.novell.com/linux/security/advisories/2008_23_openoffice.html
404 Page Not Found | SUSE
-
http://security.gentoo.org/glsa/glsa-200805-16.xml
OpenOffice.org: Multiple vulnerabilities (GLSA 200805-16) — Gentoo security
-
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=694
-
http://www.vupen.com/english/advisories/2008/1375/references
Site en constructionVendor Advisory
-
http://www.securityfocus.com/bid/28819
OpenOffice Multiple Heap Based Buffer Overflow Vulnerabilities
-
http://www.mandriva.com/security/advisories?name=MDVSA-2008:090
-
http://www.securitytracker.com/id?1019890
-
http://www.ubuntu.com/usn/usn-609-1
USN-609-1: OpenOffice.org vulnerabilities | Ubuntu security notices | Ubuntu
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10318
-
http://www.openoffice.org/security/cves/CVE-2007-5745.html
CVE-2007-5745/5747
-
http://www.redhat.com/support/errata/RHSA-2008-0175.html
-
https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00448.html
-
http://www.openoffice.org/security/cves/CVE-2008-0320.html
-
http://www.openoffice.org/security/cves/CVE-2007-4770.html
CVE-2007-4770/4771
-
http://www.redhat.com/support/errata/RHSA-2008-0176.html
Vendor Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/41860
-
http://www.openoffice.org/security/bulletin.html
Apache OpenOffice Security Team Bulletin
-
http://www.debian.org/security/2008/dsa-1547
-
http://www.mandriva.com/security/advisories?name=MDVSA-2008:095
Mandriva
-
http://sunsolve.sun.com/search/document.do?assetkey=1-26-231642-1
Jump to