Description
The WordPad Text Converter for Word 97 files in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted (1) .doc, (2) .wri, or (3) .rtf Word 97 file that triggers memory corruption, as exploited in the wild in December 2008. NOTE: As of 20081210, it is unclear whether this vulnerability is related to a WordPad issue disclosed on 20080925 with a 2008-crash.doc.rar example, but there are insufficient details to be sure.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Microsoft Windows Wordpad - '.doc' File Local Denial of Service (PoC) EDB-6560 · dos · Sep 25, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 6560 exploit
- oval:org.mitre.oval:def:6050 vdb-entry signature
- 32718 vdb-entry
- 32997 third-party-advisory
- ADV-2008-3390 vdb-entry
- TA09-104A third-party-advisory
- 31399 vdb-entry
- http://www.microsoft.com/technet/security/advisory/960906.mspx
- http://milw0rm.com/sploits/2008-crash.doc.rar
- 1021376 vdb-entry
- 4711 third-party-advisory
- MS09-010 vendor-advisory
- ADV-2009-1024 vdb-entry