PT-2009-2799 · Microsoft · Excel Viewer 2003+3

Publicado 2009-04-15 · Atualizado 2018-10-12 · CVE-2009-0100

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office Excel versions 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1 Excel in Microsoft Office 2004 and 2008 for Mac Microsoft Office Excel Viewer and Excel Viewer 2003 SP3 Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1

Description A remote code execution issue exists due to improper parsing of the Excel spreadsheet file format. This allows remote attackers to execute arbitrary code via a crafted spreadsheet containing a malformed object, which triggers a memory calculation error. If successfully exploited, an attacker could take complete control of an affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Office Excel 2000 SP3, update to a newer version to mitigate the risk. For Microsoft Office Excel 2002 SP3, update to a newer version to mitigate the risk. For Microsoft Office Excel 2003 SP3, update to a newer version to mitigate the risk. For Microsoft Office Excel 2007 SP1, update to a newer version to mitigate the risk. For Excel in Microsoft Office 2004 and 2008 for Mac, update to a newer version to mitigate the risk. For Microsoft Office Excel Viewer and Excel Viewer 2003 SP3, update to a newer version to mitigate the risk. For Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1, update to a newer version to mitigate the risk. As a temporary workaround, consider avoiding the use of malformed objects in Excel files until a patch is available.

Correção

RCE

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2009-0100

Produtos afetados

Excel Viewer 2003

Office Compatibility Pack For Word

Office Excel

Office Excel Viewer

Referências · 11

• http://vupen.com/english/advisories/2009/1023 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-0100 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0100 · Nota de Segurança
• http://securitytracker.com/id?1022039 · Nota
• http://securityfocus.com/archive/1/502696/100/0/threaded · Nota
• https://docs.microsoft.com/security-updates/securitybulletins/2009/MS09-009 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6043 · Nota
• http://osvdb.org/53665 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-009 · Aviso do Fabricante
• http://fortiguardcenter.com/advisory/FGA-2009-16.html · Nota
• http://us-cert.gov/cas/techalerts/TA09-104A.html · Nota