CVE-2008-2463 The Microsoft Office Snapshot Viewer ActiveX control in snapview.ocx 10.0.5529.0, as distributed in the standalone Snapshot Viewer and Microsoft Office Access 2000 through 2003, allows remote attacker...
MediumCVSS 6.8
EPSS 59.0%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The Microsoft Office Snapshot Viewer ActiveX control in snapview.ocx 10.0.5529.0, as distributed in the standalone Snapshot Viewer and Microsoft Office Access 2000 through 2003, allows remote attackers to download arbitrary files to a client machine via a crafted HTML document or e-mail message, probably involving use of the SnapshotPath and CompressedPath properties and the PrintSnapshot method. NOTE: this can be leveraged for code execution by writing to a Startup folder.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft office snapshot viewer activex | = office_2003 | No fix listed |
| Microsoft office snapshot viewer activex | = office_xp | No fix listed |
| Microsoft office snapshot viewer activex | = office2000 | No fix listed |
References
- HPSBST02360 vendor-advisory
- 30883 third-party-advisory
- 6124 exploit
- VU#837785 third-party-advisory us-government-resource
- www.microsoft.com
- 30114 vdb-entry
- 1020433 vdb-entry
- TA08-189A third-party-advisory us-government-resource
- TA08-225A third-party-advisory us-government-resource
- ADV-2008-2012 vdb-entry
- microsoft-snapshotviewer-code-execution(43613) vdb-entry
- oval:org.mitre.oval:def:6120 signature vdb-entry