PT-2009-2788 · Microsoft+1 · Office Converter Pack+3

Publicado 2009-04-15 · Atualizado 2019-02-26 · CVE-2009-0088

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office Word 2000 SP3 Microsoft Office Converter Pack

Description A remote code execution issue exists due to improper validation of a string length in the WordPerfect 6.x Converter, allowing attackers to execute arbitrary code via a crafted WordPerfect 6.x file. This issue is related to an unspecified counter and control structures on the stack.

Recommendations For Microsoft Office Word 2000 SP3, update the WordPerfect 6.x Converter to a version that properly validates string lengths. For Microsoft Office Converter Pack, ensure the WordPerfect 6.x converter is updated to prevent remote code execution.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2009-0088

Produtos afetados

Office Converter Pack

Office Word 2000 Sp3

Office Word

Wordperfect 6.X Converter

Referências · 10

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-010 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0088 · Nota de Segurança
• http://osvdb.org/53663 · Nota
• http://vupen.com/english/advisories/2009/1024 · Nota
• http://securitytracker.com/id?1022043 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5736 · Nota
• https://docs.microsoft.com/security-updates/securitybulletins/2009/MS09-010 · Nota
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=782 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-0088 · Nota de Segurança
• http://us-cert.gov/cas/techalerts/TA09-104A.html · Nota