CVE-2007-0028: Input Validation

Published Jan 9, 2007

Updated

Microsoft Excel 2000, 2002, 2003, Viewer 2003, Office 2004 for Mac, and Office v.X for Mac does not properly handle certain opcodes, which allows user-assisted remote attackers to execute arbitrary code via a crafted XLS file, which results in an "Improper Memory Access Vulnerability." NOTE: an early disclosure of this issue used CVE-2006-3432, but only CVE-2007-0028 should be used.

Affected Software

11 affected components

Microsoft Excel=2000

Microsoft Office=2000-sp3

Microsoft Office=xp-sp3

Microsoft Excel=2002

Microsoft Office=2003-sp2

Microsoft Excel=2003

Microsoft Excel Viewer=2003

Microsoft Works=2005

Microsoft Works=2004

Microsoft Office=2004

Microsoft Office=v.x

Remediation

Patch Available

http://www.kb.cert.org/vuls/id/493185

Event History

Jan 9, 2007

CVE Published

11:28 PM

Jan 10, 2007

CVE Published

via MITRE·04:00 AM

Data Sourced

via MITRE·04:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-0028?

CVE-2007-0028 is classified as an Improper Memory Access Vulnerability, which can allow an attacker to execute arbitrary code.

How do I fix CVE-2007-0028?

To mitigate CVE-2007-0028, users should update to the latest versions of Microsoft Excel and Office that address this vulnerability.

What versions of Microsoft software are affected by CVE-2007-0028?

CVE-2007-0028 affects Microsoft Excel 2000, 2002, 2003, Excel Viewer 2003, Office 2004 for Mac, and Office v.X for Mac.

How can an attacker exploit CVE-2007-0028?

An attacker can exploit CVE-2007-0028 by persuading a user to open a crafted XLS file, leading to arbitrary code execution.

Is user action required for CVE-2007-0028 to be exploited?

Yes, CVE-2007-0028 requires user-assisted action, specifically the opening of a malicious XLS file.