PT-2009-5455 · Microsoft · Office Excel Viewer+1

Bing Liu · Publicado 2009-11-11 · Atualizado 2018-10-12 · CVE-2009-3128

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Microsoft Office Excel versions 2002 SP3 through 2003 SP3 Office Excel Viewer version 2003 SP3

Description: A remote code execution issue exists due to improper parsing of the Excel file format, allowing attackers to execute arbitrary code via a spreadsheet with a malformed record object. This could enable an attacker to take complete control of an affected system, install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations: For Microsoft Office Excel versions 2002 SP3 through 2003 SP3, update to a newer version to mitigate the risk. For Office Excel Viewer version 2003 SP3, update to a newer version to mitigate the risk. As a temporary workaround, consider avoiding the use of specially crafted Excel files that include a malformed record object until a patch is available.

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2009-3128

Produtos afetados

Office Excel

Office Excel Viewer

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2009-3128 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-067 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3128 · Nota
• http://securitytracker.com/id?1023157 · Nota
• https://docs.microsoft.com/security-updates/securitybulletins/2009/ms09-067 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6474 · Nota
• http://us-cert.gov/cas/techalerts/TA09-314A.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3128 · Nota de Segurança