CVE-2008-6063: Infoleak
Microsoft Word 2007, when the "Save as PDF" add-on is enabled, places an absolute pathname in the Subject field during an "Email as PDF" operation, which allows remote attackers to obtain sensitive information such as the sender's account name and a Temporary Internet Files subdirectory name.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the 'Save as PDF' add-on in Microsoft Word 2007 to prevent absolute pathnames from being placed in the Subject field during 'Email as PDF' operations.
Microsoft Office Word - 'Save as PDF' add-on enabled = false - Compensating control
Avoid using the 'Email as PDF' functionality in Microsoft Word 2007 when the 'Save as PDF' add-on is present; instead save the PDF to disk and attach it manually so absolute pathnames are not included in the message Subject field.
Event History
Frequently Asked Questions
What is the severity of CVE-2008-6063?
CVE-2008-6063 has been classified with a moderate severity rating due to the potential for sensitive information exposure.
How do I fix CVE-2008-6063?
To mitigate CVE-2008-6063, disable the 'Save as PDF' add-on in Microsoft Word 2007 or apply any available security updates from Microsoft.
What sensitive information can be exposed by CVE-2008-6063?
CVE-2008-6063 can expose the sender's account name and a Temporary Internet Files subdirectory name due to the absolute pathname in the Subject field.
Which version of Microsoft Word is affected by CVE-2008-6063?
CVE-2008-6063 affects Microsoft Word 2007 when the 'Save as PDF' add-on is enabled.
Is there a workaround for CVE-2008-6063 if updates are not available?
If updates are not available for CVE-2008-6063, a temporary workaround is to avoid using the 'Email as PDF' feature in Microsoft Word 2007.