PT-2009-2796 · Microsoft · Office Visio

Bing Liu · Published 2009-02-10 · Updated 2018-10-12 · CVE-2009-0097

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office Visio versions 2002 SP2 through 2003 SP3

Description A remote code execution issue exists due to improper memory validation when handling Visio files. This could allow an attacker to execute arbitrary code by sending a specially crafted file, potentially via email or a compromised website. If successfully exploited, an attacker could gain complete control of the affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights. The impact may be less severe for users with limited system privileges.

Recommendations For Microsoft Office Visio versions 2002 SP2 through 2003 SP3, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2009-0097

Affected Products

Office Visio

References · 7

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-005 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0097 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-0097 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6188 · Note
• http://us-cert.gov/cas/techalerts/TA09-041A.html · Note
• http://vupen.com/english/advisories/2009/0391 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2009/MS09-005 · Note