CVE-2008-2463 Code injection in n/a
Remote attackers can execute arbitrary code by tricking users into opening crafted documents that exploit the Snapshot Viewer ActiveX control to write files to startup folders.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2008-2463?
CVE-2008-2463 is a medium-severity code injection vulnerability in n/a, published on 7 Jul 2008. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Microsoft Office Snapshot Viewer ActiveX control in snapview.ocx 10.0.5529.0, as distributed in the standalone Snapshot Viewer and Microsoft Office Access 2000 through 2003, allows remote attackers to download arbitrary files to a client machine via a crafted HTML document or e-mail message, probably involving use of the SnapshotPath and CompressedPath properties and the PrintSnapshot method. NOTE: this can be leveraged for code execution by writing to a Startup folder.
Weakness: CWE-94
Which versions are affected by CVE-2008-2463?
It affects 1 product.
Products include Microsoft Office Snapshot Viewer Activex.
How do I fix CVE-2008-2463?
No fix has been published for CVE-2008-2463 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2008-2463 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2008-2463 exists.
Public exploit code: 1 Metasploit module and 2 Exploit-DB entries.
Sources
Also known as GHSA-frx4-jc3x-7q59.