PT-2009-2912 · Microsoft · Compatibility Pack For Word+3

Published 2009-02-25 · Updated 2026-04-14 · CVE-2009-0238

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Office Excel versions 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1 Excel Viewer 2003 Gold and SP3 Excel Viewer Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 Microsoft Office 2004 and 2008 for Mac

Description A remote code execution issue exists, allowing attackers to execute arbitrary code via a crafted Excel document that triggers an access attempt on an invalid object. This has been exploited in the wild, potentially allowing an attacker to take complete control of an affected system, install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Office Excel 2000 SP3, update to a newer version to mitigate the risk. For Microsoft Office Excel 2002 SP3, update to a newer version to mitigate the risk. For Microsoft Office Excel 2003 SP3, update to a newer version to mitigate the risk. For Microsoft Office Excel 2007 SP1, update to a newer version to mitigate the risk. For Excel Viewer 2003 Gold and SP3, update to a newer version to mitigate the risk. For Excel Viewer, update to a newer version to mitigate the risk. For Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1, update to a newer version to mitigate the risk. For Microsoft Office 2004 and 2008 for Mac, update to a newer version to mitigate the risk. As a temporary workaround, consider avoiding the use of crafted Excel files until a patch is available.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-0238

Affected Products

Compatibility Pack For Word

Excel Viewer

Office

Office Excel

References · 18

• https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-009 · Security Note
• http://microsoft.com/technet/security/advisory/968272.mspx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0238 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-009 · Vendor Advisory
• http://blogs.zdnet.com/security/?p=2658 · Note
• http://us-cert.gov/cas/techalerts/TA09-104A.html · Note
• https://twitter.com/battista212/status/2044174882779386217 · Twitter Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-0238 · Note
• http://securitytracker.com/id?1021744 · Note
• http://vupen.com/english/advisories/2009/1023 · Note
• https://twitter.com/CISACyber/status/2044118019165540827 · Twitter Post
• https://twitter.com/NewsNerdie/status/2044125303530836031 · Twitter Post
• http://securityfocus.com/bid/33870 · Note
• https://twitter.com/ZettaWire/status/2044118342936518990 · Twitter Post
• http://isc.sans.org/diary.html?storyid=5923 · Note