PT-2009-2787 · Microsoft · Office Word+2

Published 2009-04-15 · Updated 2018-10-30 · CVE-2009-0087

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the patchday that contains the fix for the vulnerability Microsoft Office Word versions prior to the patchday that contains the fix for the vulnerability

Description A remote code execution issue exists in the way that text converters in WordPad and Microsoft Office process memory when a user opens a specially crafted Word 6 file that includes malformed data. This allows remote attackers to execute arbitrary code via a crafted Word 6 file.

Recommendations For Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2, update to a version that includes the patch for this issue. For Microsoft Office Word 2000 SP3 and 2002 SP3, update to a version that includes the patch for this issue. As a temporary workaround, consider restricting the use of the Word 6 text converter in WordPad and Microsoft Office until a patch is available.

Fix

Related Identifiers

CVE-2009-0087

Affected Products

Office Word

Windows

Wordpad

References · 9

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0087 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-0087 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-010 · Vendor Advisory
• http://vupen.com/english/advisories/2009/1024 · Note
• http://securitytracker.com/id?1022043 · Note
• http://us-cert.gov/cas/techalerts/TA09-104A.html · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5799 · Note
• http://osvdb.org/53662 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2009/MS09-010 · Note