MS.Office.PICT.Heap.Corruption

Release Date Aug 15, 2008
Severity critical
Impact System Compromise: Remote attackers can gain control of vulnerable systems.
Description This indicates a possible attempt to exploit a heap corruption vulnerability in Microsoft Office. The vulnerability is caused by an error that occurs when the vulnerable software handles an imported PICT file. A remote attacker may exploit this to execute arbitrary code via a crafted PICT file.
Affected Products Microsoft Office 2000 Service Pack 3 Microsoft Office XP Service Pack 3 Microsoft Office 2003 Service Pack 2 Microsoft Office Project 2002 Service Pack 1 Microsoft Office Converter Pack Microsoft Works 8
Recommended Actions Refer to the vendor's web site for the suggested workaround: http://www.microsoft.com/technet/security/Bulletin/ms08-044.mspx
Coverage IPS VCM
Common Vulnerabilities and Exposures (CVE) CVE-2008-3018 CVE-2006-1307
Reference/s http://www.microsoft.com/technet/security/Bulletin/ms08-044.mspx (MS-ID) http://www.securityfocus.com/bid/30597 (BugTraq)

Fortinet