PT-2009-2794 · Microsoft · Office Visio

Bing Liu · Published 2009-02-10 · Updated 2018-10-12 · CVE-2009-0095

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office Visio versions 2002 SP2, 2003 SP3, and 2007 SP1

Description A remote code execution issue exists due to improper validation of object data in Visio files. This allows attackers to execute arbitrary code via a crafted file. An attacker could exploit this by sending a specially crafted file, which could be included as an e-mail attachment or hosted on a specially crafted or compromised web site. If successfully exploited, an attacker could take complete control of an affected system, allowing them to install programs, view, change, or delete data, or create new accounts with full user rights. The impact is reduced for users with fewer user rights on the system compared to those operating with administrative user rights.

Recommendations For Microsoft Office Visio 2002 SP2, consider applying the necessary patch to fix the memory validation issue. For Microsoft Office Visio 2003 SP3, apply the patch that addresses the object data validation vulnerability. For Microsoft Office Visio 2007 SP1, update to a version that includes the fix for the remote code execution vulnerability.

Fix

RCE

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2009-0095

Affected Products

Office Visio

References · 7

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-005 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0095 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0095 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6179 · Note
• http://us-cert.gov/cas/techalerts/TA09-041A.html · Note
• http://vupen.com/english/advisories/2009/0391 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2009/MS09-005 · Note