PT-2009-3207 · Microsoft · Office For Mac+3

Carsten H. Eiram · Published 2009-06-10 · Updated 2018-10-12 · CVE-2009-0558

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office versions 2000 SP3 and earlier Microsoft Office for Mac versions 2004 and 2008 Open XML File Format Converter for Mac (affected versions not specified)

Description A remote code execution issue exists in Microsoft Office Excel, allowing attackers to execute arbitrary code via a crafted Excel file with a malformed record object. This could enable an attacker to take complete control of an affected system, install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Office 2000 SP3 and earlier, update to a version that includes the fix for this issue. For Microsoft Office for Mac versions 2004 and 2008, update to a version that includes the fix for this issue. For Open XML File Format Converter for Mac, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-0558

Affected Products

Office

Office Excel

Office For Mac

Open Xml File Format Converter For Mac

References · 12

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-021 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0558 · Security Note
• http://secunia.com/secunia_research/2009-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0558 · Security Note
• http://osvdb.org/54954 · Note
• http://vupen.com/english/advisories/2009/1540 · Note
• http://securityfocus.com/archive/1/504188/100/0/threaded · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11525 · Note
• http://securitytracker.com/id?1022351 · Note
• http://us-cert.gov/cas/techalerts/TA09-160A.html · Note
• http://securityfocus.com/bid/35242 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2009/MS09-021 · Note