PT-2009-3211 · Microsoft · Office Small Business Accounting+5

Peter Vreugdenhil · Publicado 2009-08-12 · Atualizado 2018-10-12 · CVE-2009-0562

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office XP SP3 Microsoft Office 2003 SP3 Microsoft Office XP Web Components SP3 Microsoft Office 2003 Web Components SP3 Microsoft Office 2003 Web Components SP1 for the 2007 Microsoft Office System Internet Security and Acceleration (ISA) Server 2004 SP3 Internet Security and Acceleration (ISA) Server 2006 SP1 Microsoft Office Small Business Accounting 2006

Description The issue is related to improper memory allocation by the Office Web Components ActiveX Control, allowing remote attackers to execute arbitrary code. This is achieved through unspecified vectors that trigger system state corruption.

Recommendations For Microsoft Office XP SP3, update to a version that properly allocates memory to prevent arbitrary code execution. For Microsoft Office 2003 SP3, update to a version that properly allocates memory to prevent arbitrary code execution. For Microsoft Office XP Web Components SP3, update to a version that properly allocates memory to prevent arbitrary code execution. For Microsoft Office 2003 Web Components SP3, update to a version that properly allocates memory to prevent arbitrary code execution. For Microsoft Office 2003 Web Components SP1 for the 2007 Microsoft Office System, update to a version that properly allocates memory to prevent arbitrary code execution. For Internet Security and Acceleration (ISA) Server 2004 SP3, update to a version that properly allocates memory to prevent arbitrary code execution. For Internet Security and Acceleration (ISA) Server 2006 SP1, update to a version that properly allocates memory to prevent arbitrary code execution. For Microsoft Office Small Business Accounting 2006, update to a version that properly allocates memory to prevent arbitrary code execution.

Correção

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2009-0562

Produtos afetados

Internet Security/Acceleration (Isa) Server

Office 2003

Office 2003 Web Components

Office Small Business Accounting

Office Xp

Office Web Components

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2009-0562 · Nota de Segurança
• http://securitytracker.com/id?1022708 · Nota
• http://us-cert.gov/cas/techalerts/TA09-223A.html · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-043 · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6337 · Nota