PT-2009-4910 · Microsoft · Sql Server 2000+27

Published 2009-10-14 · Updated 2023-12-07 · CVE-2009-2503

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer 6 SP1 Windows XP SP2 and SP3 Windows Server 2003 SP2 Office XP SP3 Office 2003 SP3 2007 Microsoft Office System SP1 and SP2 Office Project 2002 SP1 Visio 2002 SP2 Office Word Viewer Word Viewer 2003 Gold and SP3 Office Excel Viewer 2003 Gold and SP3 Office Excel Viewer Office PowerPoint Viewer 2007 Gold, SP1, and SP2 Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 Expression Web Expression Web 2 Groove 2007 Gold and SP1 Works 8.5 SQL Server 2000 Reporting Services SP2 SQL Server 2005 SP2 and SP3 Report Viewer 2005 SP1 Report Viewer 2008 Gold and SP1 Forefront Client Security 1.0

Description A remote code execution issue exists due to improper memory allocation by GDI+ when handling crafted TIFF image files. This allows remote attackers to execute arbitrary code, potentially giving them complete control over the affected system. They could then install programs, view, change, or delete data, or create new accounts with full user rights. Users with limited account privileges may be less affected than those operating with administrative rights.

Recommendations For Microsoft Internet Explorer 6 SP1, update to a newer version to mitigate the risk. For Windows XP SP2 and SP3, apply the relevant security patch. For Windows Server 2003 SP2, apply the relevant security patch. For Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, apply the relevant security patch. For Office Project 2002 SP1, Visio 2002 SP2, Office Word Viewer, Word Viewer 2003 Gold and SP3, Office Excel Viewer 2003 Gold and SP3, Office Excel Viewer, Office PowerPoint Viewer 2007 Gold, SP1, and SP2, apply the relevant security patch. For Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2, Expression Web, Expression Web 2, Groove 2007 Gold and SP1, Works 8.5, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2 and SP3, Report Viewer 2005 SP1, Report Viewer 2008 Gold and SP1, Forefront Client Security 1.0, apply the relevant security patch. As a temporary workaround, consider disabling the handling of TIFF files until a patch is available.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-2503

Affected Products

2007 Microsoft Office System

Expression Web

Expression Web 2

Forefront Client Security

Groove 2007

Internet Explorer 6

Sql Server

Office

Office 2003

Office Compatibility Pack

Office Excel Viewer

Office Excel Viewer 2003

Office Powerpoint Viewer 2007

Office Project

Office Project 2002

Office Visio

Office Word Viewer

Office Xp

Report Viewer 2005

Report Viewer 2008

Sql Server 2000

Sql Server 2005

Visio 2002

Windows

Windows Server 2003

Windows Xp

Word Viewer 2003

Works 8.5

References · 7

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2503 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-2503 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-062 · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6491 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2009/ms09-062 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2503 · Note
• http://us-cert.gov/cas/techalerts/TA09-286A.html · Note