PT-2009-4909 · Microsoft · Sql Server 2000+26

Published 2009-10-14 · Updated 2024-10-21 · CVE-2009-2502

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer 6 SP1 Windows XP SP2 and SP3 Office XP SP3 Office 2003 SP3 2007 Microsoft Office System SP1 and SP2 Office Project 2002 SP1 Visio 2002 SP2 Office Word Viewer Word Viewer 2003 Gold and SP3 Office Excel Viewer 2003 Gold and SP3 Office Excel Viewer Office PowerPoint Viewer 2007 Gold, SP1, and SP2 Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 Expression Web Expression Web 2 Groove 2007 Gold and SP1 Works 8.5 SQL Server 2000 Reporting Services SP2 SQL Server 2005 SP2 and SP3 Report Viewer 2005 SP1 Report Viewer 2008 Gold and SP1 Forefront Client Security 1.0

Description A remote code execution issue exists due to the way GDI+ allocates memory. This could allow remote code execution if a user opens a specially crafted TIFF file. An attacker who successfully exploits this issue could take complete control of an affected system, then install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights on the system could be less impacted than those operating with administrative user rights.

Recommendations As a temporary workaround, consider disabling the handling of TIFF files until a patch is available. Restrict access to GDI+ to minimize the risk of exploitation. Avoid opening specially crafted TIFF files in affected applications until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-120

Related Identifiers

CVE-2009-2502

Affected Products

2007 Microsoft Office System

Expression Web

Expression Web 2

Forefront Client Security

Groove 2007

Internet Explorer 6

Sql Server

Office

Office 2003

Office Compatibility Pack

Office Excel Viewer

Office Excel Viewer 2003

Office Powerpoint Viewer 2007

Office Project

Office Project 2002

Office Visio

Office Word Viewer

Office Xp

Report Viewer 2005

Report Viewer 2008

Sql Server 2000

Sql Server 2005

Visio 2002

Windows

Windows Xp

Word Viewer 2003

Works 8.5

References · 8

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2502 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-062 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2502 · Security Note
• https://t.me/cvenotify/99003 · Telegram Post
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5898 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2502 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2009/ms09-062 · Note
• http://us-cert.gov/cas/techalerts/TA09-286A.html · Note