PT-2009-3211 · Microsoft · Office Small Business Accounting+5

Peter Vreugdenhil · Published 2009-08-12 · Updated 2018-10-12 · CVE-2009-0562

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office XP SP3 Microsoft Office 2003 SP3 Microsoft Office XP Web Components SP3 Microsoft Office 2003 Web Components SP3 Microsoft Office 2003 Web Components SP1 for the 2007 Microsoft Office System Internet Security and Acceleration (ISA) Server 2004 SP3 Internet Security and Acceleration (ISA) Server 2006 SP1 Microsoft Office Small Business Accounting 2006

Description The issue is related to improper memory allocation by the Office Web Components ActiveX Control, allowing remote attackers to execute arbitrary code. This is achieved through unspecified vectors that trigger system state corruption.

Recommendations For Microsoft Office XP SP3, update to a version that properly allocates memory to prevent arbitrary code execution. For Microsoft Office 2003 SP3, update to a version that properly allocates memory to prevent arbitrary code execution. For Microsoft Office XP Web Components SP3, update to a version that properly allocates memory to prevent arbitrary code execution. For Microsoft Office 2003 Web Components SP3, update to a version that properly allocates memory to prevent arbitrary code execution. For Microsoft Office 2003 Web Components SP1 for the 2007 Microsoft Office System, update to a version that properly allocates memory to prevent arbitrary code execution. For Internet Security and Acceleration (ISA) Server 2004 SP3, update to a version that properly allocates memory to prevent arbitrary code execution. For Internet Security and Acceleration (ISA) Server 2006 SP1, update to a version that properly allocates memory to prevent arbitrary code execution. For Microsoft Office Small Business Accounting 2006, update to a version that properly allocates memory to prevent arbitrary code execution.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2009-0562

Affected Products

Internet Security/Acceleration (Isa) Server

Office 2003

Office 2003 Web Components

Office Small Business Accounting

Office Xp

Office Web Components

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2009-0562 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-043 · Vendor Advisory
• http://securitytracker.com/id?1022708 · Note
• http://us-cert.gov/cas/techalerts/TA09-223A.html · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6337 · Note