PT-2009-3698 · Microsoft · Office Excel+2

Published 2009-06-10 · Updated 2018-10-12 · CVE-2009-1134

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office Excel versions in 2007 Microsoft Office System SP1 and SP2 Microsoft Office Excel Viewer Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2

Description A remote code execution issue exists in Microsoft Office Excel, allowing attackers to execute arbitrary code via a specially crafted Excel file with a malformed record object, specifically a BIFF file with a malformed Qsir (0x806) record object. If successfully exploited, an attacker could take complete control of an affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Office Excel versions in 2007 Microsoft Office System SP1 and SP2, update to a version that includes the fix for this issue. For Microsoft Office Excel Viewer, update to a version that includes the fix for this issue. For Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2, update to a version that includes the fix for this issue. As a temporary workaround, consider avoiding the use of BIFF files with malformed Qsir (0x806) record objects until a patch is available.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-1134

Affected Products

Office Compatibility Pack For Word

Office Excel

Office Excel Viewer

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2009-1134 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1134 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-021 · Vendor Advisory
• http://vupen.com/english/advisories/2009/1540 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2009/MS09-021 · Note
• http://securityfocus.com/bid/35246 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5922 · Note
• http://osvdb.org/54958 · Note
• http://zerodayinitiative.com/advisories/ZDI-09-040 · Note
• http://us-cert.gov/cas/techalerts/TA09-160A.html · Note
• http://securitytracker.com/id?1022351 · Note
• http://securityfocus.com/archive/1/504213/100/0/threaded · Note