PT-2009-2799 · Microsoft · Excel Viewer 2003+3

Published 2009-04-15 · Updated 2018-10-12 · CVE-2009-0100

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office Excel versions 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1 Excel in Microsoft Office 2004 and 2008 for Mac Microsoft Office Excel Viewer and Excel Viewer 2003 SP3 Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1

Description A remote code execution issue exists due to improper parsing of the Excel spreadsheet file format. This allows remote attackers to execute arbitrary code via a crafted spreadsheet containing a malformed object, which triggers a memory calculation error. If successfully exploited, an attacker could take complete control of an affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Office Excel 2000 SP3, update to a newer version to mitigate the risk. For Microsoft Office Excel 2002 SP3, update to a newer version to mitigate the risk. For Microsoft Office Excel 2003 SP3, update to a newer version to mitigate the risk. For Microsoft Office Excel 2007 SP1, update to a newer version to mitigate the risk. For Excel in Microsoft Office 2004 and 2008 for Mac, update to a newer version to mitigate the risk. For Microsoft Office Excel Viewer and Excel Viewer 2003 SP3, update to a newer version to mitigate the risk. For Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1, update to a newer version to mitigate the risk. As a temporary workaround, consider avoiding the use of malformed objects in Excel files until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2009-0100

Affected Products

Excel Viewer 2003

Office Compatibility Pack For Word

Office Excel

Office Excel Viewer

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2009-0100 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0100 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-009 · Vendor Advisory
• http://vupen.com/english/advisories/2009/1023 · Note
• http://securitytracker.com/id?1022039 · Note
• http://securityfocus.com/archive/1/502696/100/0/threaded · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2009/MS09-009 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6043 · Note
• http://osvdb.org/53665 · Note
• http://fortiguardcenter.com/advisory/FGA-2009-16.html · Note
• http://us-cert.gov/cas/techalerts/TA09-104A.html · Note