CVE-2007-0671 (CNNVD-200702-013)
中文标题:
Microsoft Excel畸形字符串远程代码执行漏洞(MS07-015)
英文标题:
Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Of...
漏洞描述
中文描述:
Microsoft Excel是非常流行的电子表格处理办公软件。 Microsoft Excel处理畸形文件格式时存在漏洞，远程攻击者可能利用此漏洞通过诱骗用户打开恶意文件控制用户机器。 如果用户受骗打开了恶意的Excel文件的话，就可能导致执行任意代码。目前这个漏洞正在被名为Exploit-MSExcel.h的木马积极地利用。在打开畸形的XLS文件时会执行以下操作： * 在内存中解压异或加密的shellcode * 对于Windows XP Service Pack 2，使用硬编码的地址加载KERNEL32.DLL；对于其他Windows版本，Excel会崩溃 * 使用API调用GetTempPathA和CreateFileA在%Temp%\top10.exe中创建新文件 * 使用API调用GetFileSize在内存中查找打开的XLS文件句柄，匹配特定的文件大小 * 从XLS文件中解压有效负载并写入%Temp%\top10.exe * 执行%Temp%\top10.exe <*链接：http://secunia.com/advisories/24008/ http://www.avertlabs.com/research/blog/?p=191 http://www.microsoft.com/technet/security/advisory/932553.mspx?pf=true http://vil.nai.com/vil/content/v_141393.htm http://www.microsoft.com/technet/security/Bulletin/ms07-015.mspx?pf=true http://www.us-cert.gov/cas/techalerts/TA07-044A.html *>
英文描述:
Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attackers to execute arbitrary code via unknown attack vectors, as demonstrated by Exploit-MSExcel.h in targeted zero-day attacks.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| microsoft | access | 2000 | - | - |
cpe:2.3:a:microsoft:access:2000:*:*:*:*:*:*:*
|
| microsoft | access | 2002 | - | - |
cpe:2.3:a:microsoft:access:2002:*:*:*:*:*:*:*
|
| microsoft | access | 2003 | - | - |
cpe:2.3:a:microsoft:access:2003:*:*:*:*:*:*:*
|
| microsoft | excel | 2000 | - | - |
cpe:2.3:a:microsoft:excel:2000:*:*:*:*:*:*:*
|
| microsoft | excel | 2002 | - | - |
cpe:2.3:a:microsoft:excel:2002:*:*:*:*:*:*:*
|
| microsoft | excel | 2003 | - | - |
cpe:2.3:a:microsoft:excel:2003:*:*:*:*:*:*:*
|
| microsoft | excel | 2004 | - | - |
cpe:2.3:a:microsoft:excel:2004:*:mac:*:*:*:*:*
|
| microsoft | excel_viewer | 2003 | - | - |
cpe:2.3:a:microsoft:excel_viewer:2003:*:*:*:*:*:*:*
|
| microsoft | frontpage | 2000 | - | - |
cpe:2.3:a:microsoft:frontpage:2000:*:*:*:*:*:*:*
|
| microsoft | frontpage | 2002 | - | - |
cpe:2.3:a:microsoft:frontpage:2002:*:*:*:*:*:*:*
|
| microsoft | frontpage | 2003 | - | - |
cpe:2.3:a:microsoft:frontpage:2003:*:*:*:*:*:*:*
|
| microsoft | infopath | 2003 | - | - |
cpe:2.3:a:microsoft:infopath:2003:*:*:*:*:*:*:*
|
| microsoft | office | 2000 | - | - |
cpe:2.3:a:microsoft:office:2000:sp3:*:*:*:*:*:*
|
| microsoft | office | 2003 | - | - |
cpe:2.3:a:microsoft:office:2003:sp2:*:*:*:*:*:*
|
| microsoft | office | 2004 | - | - |
cpe:2.3:a:microsoft:office:2004:*:mac:*:*:*:*:*
|
| microsoft | office | xp | - | - |
cpe:2.3:a:microsoft:office:xp:sp3:*:*:*:*:*:*
|
| microsoft | onenote | 2003 | - | - |
cpe:2.3:a:microsoft:onenote:2003:*:*:*:*:*:*:*
|
| microsoft | outlook | 2000 | - | - |
cpe:2.3:a:microsoft:outlook:2000:*:*:*:*:*:*:*
|
| microsoft | outlook | 2002 | - | - |
cpe:2.3:a:microsoft:outlook:2002:*:*:*:*:*:*:*
|
| microsoft | outlook | 2003 | - | - |
cpe:2.3:a:microsoft:outlook:2003:*:*:*:*:*:*:*
|
| microsoft | powerpoint | 2000 | - | - |
cpe:2.3:a:microsoft:powerpoint:2000:*:*:*:*:*:*:*
|
| microsoft | powerpoint | 2002 | - | - |
cpe:2.3:a:microsoft:powerpoint:2002:*:*:*:*:*:*:*
|
| microsoft | powerpoint | 2003 | - | - |
cpe:2.3:a:microsoft:powerpoint:2003:*:*:*:*:*:*:*
|
| microsoft | powerpoint | 2004 | - | - |
cpe:2.3:a:microsoft:powerpoint:2004:*:mac:*:*:*:*:*
|
| microsoft | project | 2000 | - | - |
cpe:2.3:a:microsoft:project:2000:sr1:*:*:*:*:*:*
|
| microsoft | project | 2002 | - | - |
cpe:2.3:a:microsoft:project:2002:sp1:*:*:*:*:*:*
|
| microsoft | project | 2003 | - | - |
cpe:2.3:a:microsoft:project:2003:*:*:*:*:*:*:*
|
| microsoft | publisher | 2000 | - | - |
cpe:2.3:a:microsoft:publisher:2000:*:*:*:*:*:*:*
|
| microsoft | publisher | 2002 | - | - |
cpe:2.3:a:microsoft:publisher:2002:*:*:*:*:*:*:*
|
| microsoft | publisher | 2003 | - | - |
cpe:2.3:a:microsoft:publisher:2003:*:*:*:*:*:*:*
|
| microsoft | visio | 2002 | - | - |
cpe:2.3:a:microsoft:visio:2002:sp2:*:*:*:*:*:*
|
| microsoft | visio | 2003 | - | - |
cpe:2.3:a:microsoft:visio:2003:*:*:*:*:*:*:*
|
| microsoft | word | 2000 | - | - |
cpe:2.3:a:microsoft:word:2000:*:*:*:*:*:*:*
|
| microsoft | word | 2002 | - | - |
cpe:2.3:a:microsoft:word:2002:*:*:*:*:*:*:*
|
| microsoft | word | 2003 | - | - |
cpe:2.3:a:microsoft:word:2003:*:*:*:*:*:*:*
|
| microsoft | word_viewer | 2003 | - | - |
cpe:2.3:a:microsoft:word_viewer:2003:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
参考链接
cve.org
cve.org
cve.org
cve.org
cve.org
cve.org
cve.org
cve.org
cve.org
cve.org
cve.org
cve.org
cve.org
nvd.nist.gov
nvd.nist.gov
CVSS评分详情
3.1 (adp)
HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2007-0671 |
2025-11-11 15:17:49 | 2025-11-11 07:32:41 |
| NVD | nvd_CVE-2007-0671 |
2025-11-11 14:52:09 | 2025-11-11 07:41:27 |
| CNNVD | cnnvd_CNNVD-200702-013 |
2025-11-11 15:08:55 | 2025-11-11 07:49:14 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 授权问题
- cnnvd_id: 未提取 -> CNNVD-200702-013
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 0 -> 36
- references_count: 13 -> 15
- data_sources: ['cve'] -> ['cve', 'nvd']