Alert GCSA-08023 - MS08-014 Vulnerabilita' in Microsoft Excel (949029)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


******************************************************************

    Alert ID : GCSA-08023
        Data : 12 marzo 2008
      Titolo : MS08-014 Vulnerabilita' in Microsoft Excel (949029)

******************************************************************


:: Descrizione del problema

    Sono stati individuati vari bug in Excel che potrebbero causare
    errori di corruzione della memoria durante l'elaborazione di
    documenti contenenti dati malformati (per esempio Style Record,
    Formule, Rich Text, o Macro). Un agressore puo' sfruttarli
    inducendo l'utente ad aprire file artefatti.


:: Software interessato

    Office 2000 SP3 (Excel 2000 SP3)
    Office XP SP3   (Excel 2002 SP3)
    Office 2003 SP2 (Excel 2003 SP2)
    2007 Microsoft Office System (Excel 2007)
    Office Excel Viewer 2003
    Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats
    Office 2004 for Mac
    Office 2008 for Mac


:: Impatto

    Esecuzione remota di codice arbitrario
    Conquista del controllo completo sul sistema
    Installazione di programmi
    Lettura, modifica e cancellazione di dati
    Creazione di nuovi account


:: Soluzioni

    Installare manualmente la patch elencata nel bollettino Microsoft,
    oppure utilizzare uno degli strumenti di aggiornamento come:
    Aggiornamenti Automatici, Windows Update, Microsoft Update,
    Windows Server Update Services.


:: Riferimenti

    Microsoft Security Bulletin
    http://www.microsoft.com/technet/security/bulletin/MS08-014.mspx

    Microsoft Knowledge Base
    http://support.microsoft.com/kb/949029

    Microsoft Security Advisory
    http://www.microsoft.com/technet/security/advisory/947563.mspx

    Microsoft Update
    https://update.microsoft.com/microsoftupdate/

    Mitre's CVE ID
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0081
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0111
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0112
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0114
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0115
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0116
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0117

    Secunia advisories
    http://secunia.com/advisories/28506

    FrSIRT
    http://www.frsirt.com/english/advisories/2008/0146
    http://www.frsirt.com/english/advisories/2008/0846

    Securityfocus Bugtraq ID
    http://www.securityfocus.com/bid/27305
    http://www.securityfocus.com/bid/28094
    http://www.securityfocus.com/bid/28095
    http://www.securityfocus.com/bid/28166
    http://www.securityfocus.com/bid/28167
    http://www.securityfocus.com/bid/28168
    http://www.securityfocus.com/bid/28170

    TippingPoint DVLabs
    http://dvlabs.tippingpoint.com/advisory/TPTI-08-03

    iDefense Labs
    http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=671
    http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=672

-----BEGIN PGP SIGNATURE-----

iQCVAwUBR9ef2POB+SpikaiRAQIUlQQA0L5E2WkoobjqzR9tTEM1kqOM9ElYzOKf
OtIsIV7xoIhaYtULhcleDFAjuDmQJPx3b/gaK+RCG2Agsv7eqnPsEf08+OvBXt5N
+Hle3X0fg8A4jIrFXVGCwXrxzEqZbCpU5orYlJd5bhk5GEvqT38i4pWlGJuDzflw
5Bg+sQbcYYs=
=OPhH
-----END PGP SIGNATURE-----