PT-2009-2788 · Microsoft+1 · Office Converter Pack+3

Published 2009-04-15 · Updated 2019-02-26 · CVE-2009-0088

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office Word 2000 SP3 Microsoft Office Converter Pack

Description A remote code execution issue exists due to improper validation of a string length in the WordPerfect 6.x Converter, allowing attackers to execute arbitrary code via a crafted WordPerfect 6.x file. This issue is related to an unspecified counter and control structures on the stack.

Recommendations For Microsoft Office Word 2000 SP3, update the WordPerfect 6.x Converter to a version that properly validates string lengths. For Microsoft Office Converter Pack, ensure the WordPerfect 6.x converter is updated to prevent remote code execution.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2009-0088

Affected Products

Office Converter Pack

Office Word 2000 Sp3

Office Word

Wordperfect 6.X Converter

References · 10

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-010 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0088 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-0088 · Security Note
• http://osvdb.org/53663 · Note
• http://vupen.com/english/advisories/2009/1024 · Note
• http://securitytracker.com/id?1022043 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5736 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2009/MS09-010 · Note
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=782 · Note
• http://us-cert.gov/cas/techalerts/TA09-104A.html · Note