PT-2009-2796 · Microsoft · Office Visio

Bing Liu · Publicado 2009-02-10 · Atualizado 2018-10-12 · CVE-2009-0097

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office Visio versions 2002 SP2 through 2003 SP3

Description A remote code execution issue exists due to improper memory validation when handling Visio files. This could allow an attacker to execute arbitrary code by sending a specially crafted file, potentially via email or a compromised website. If successfully exploited, an attacker could gain complete control of the affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights. The impact may be less severe for users with limited system privileges.

Recommendations For Microsoft Office Visio versions 2002 SP2 through 2003 SP3, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2009-0097

Produtos afetados

Office Visio

Referências · 7

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-005 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0097 · Nota de Segurança
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6188 · Nota
• http://us-cert.gov/cas/techalerts/TA09-041A.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-0097 · Nota de Segurança
• http://vupen.com/english/advisories/2009/0391 · Nota
• https://docs.microsoft.com/security-updates/securitybulletins/2009/MS09-005 · Nota