Microsoft Word 信息泄露漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1183825 漏洞类型 信息泄露
发布时间 2009-02-04 更新时间 2009-02-04
CVE编号 CVE-2008-6063 CNNVD-ID CNNVD-200902-093
漏洞平台 N/A CVSS评分 4.3
|漏洞来源
https://www.securityfocus.com/bid/84630
https://cxsecurity.com/issue/WLB-2009020136
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200902-093
|漏洞详情
Word是Microsoft开发的被普遍使用的文档编辑软件。当"以PDF格式进行保存"的add-on被激活时,MicrosoftWord2007会在"EmailasPDF"操作中,将一个绝对路径名放置在Subject字段中,这使得远程攻击者可以获得敏感信息,诸如发送人的账户名和一个临时的Internet文件次目录名。
|漏洞EXP
Intro:

Word 2007 is the latest installment of Microsoft's word processing program

Bug:

Word 2007 with the "save as pdf" add-on is vulnerable to a path disclosure when using the feature's email as pdf option, accessible through the office button. This feature enables a user to email a word doc as a pdf without saving it as a pdf first. When doing so, the full path to the file is placed on the subject line of the email being drafted. When working with documents that are not resident on the user's drive or an accessible network share (such as an email attachment or web page) the path to the temporary file that is created is placed in the subject line. Like so:

From: Joey Jackrabbit

Sent: Friday, November 30, 2007 2:15 PM

To: Jacob Smith

Cc: John Smith

Subject: C:\Documents and Settings\ebk\Local Settings\Temporary Internet Files\Content.Outlook\FIZK8FYG\My new Document

Testing revealed that only Word exhibits this behavior.

Timeline:

11/30/07 Discovered

11/30/07 Reported to MS

1/8/08 MS Reported this will be addressed in next version/service pack

Workaround:

Delete the path information from the subject line before sending the email
|受影响的产品
Microsoft Word 2007 0
|参考资料

来源:BUGTRAQ
名称:20080110Word2007EmailasPDFpathdisclosureflaw
链接:http://www.securityfocus.com/archive/1/archive/1/486088/100/0/threaded