PT-2009-4911 · Microsoft · Sql Server 2000 Reporting Services+29

Published 2009-10-14 · Updated 2023-12-07 · CVE-2009-2504

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 1.1 SP1 through 2.0 SP2 Windows XP versions SP2 through SP3 Windows Server 2003 version SP2 Windows Vista versions Gold through SP1 Windows Server 2008 version Gold Microsoft Office XP version SP3 Microsoft Office 2003 version SP3 2007 Microsoft Office System versions SP1 through SP2 Microsoft Office Project 2002 version SP1 Microsoft Visio 2002 version SP2 Microsoft Office Word Viewer Microsoft Word Viewer 2003 versions Gold through SP3 Microsoft Office Excel Viewer 2003 versions Gold through SP3 Microsoft Office Excel Viewer Microsoft Office PowerPoint Viewer 2007 versions Gold through SP2 Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats versions SP1 through SP2 Microsoft Expression Web Microsoft Expression Web 2 Microsoft Groove 2007 versions Gold through SP1 Microsoft Works 8.5 Microsoft SQL Server 2000 Reporting Services version SP2 Microsoft SQL Server 2005 versions SP2 through SP3 Microsoft Report Viewer 2005 version SP1 Microsoft Report Viewer 2008 versions Gold through SP1 Microsoft Forefront Client Security 1.0

Description A remote code execution issue exists in GDI+ that can allow a malicious Microsoft .NET application to gain unmanaged code execution privileges. This issue can be exploited via a crafted XAML browser application (XBAP), a crafted ASP.NET application, or a crafted .NET Framework application. Microsoft .NET applications that are not malicious are not at risk for being compromised because of this issue.

Recommendations For Microsoft .NET Framework versions 1.1 SP1 through 2.0 SP2, update to a newer version to mitigate the risk. For Windows XP versions SP2 through SP3, apply the patch provided by Microsoft to resolve the issue. For Windows Server 2003 version SP2, apply the patch provided by Microsoft to resolve the issue. For Windows Vista versions Gold through SP1, apply the patch provided by Microsoft to resolve the issue. For Windows Server 2008 version Gold, apply the patch provided by Microsoft to resolve the issue. For Microsoft Office XP version SP3, apply the patch provided by Microsoft to resolve the issue. For Microsoft Office 2003 version SP3, apply the patch provided by Microsoft to resolve the issue. For 2007 Microsoft Office System versions SP1 through SP2, apply the patch provided by Microsoft to resolve the issue. For Microsoft Office Project 2002 version SP1, apply the patch provided by Microsoft to resolve the issue. For Microsoft Visio 2002 version SP2, apply the patch provided by Microsoft to resolve the issue. For Microsoft Office Word Viewer, apply the patch provided by Microsoft to resolve the issue. For Microsoft Word Viewer 2003 versions Gold through SP3, apply the patch provided by Microsoft to resolve the issue. For Microsoft Office Excel Viewer 2003 versions Gold through SP3, apply the patch provided by Microsoft to resolve the issue. For Microsoft Office Excel Viewer, apply the patch provided by Microsoft to resolve the issue. For Microsoft Office PowerPoint Viewer 2007 versions Gold through SP2, apply the patch provided by Microsoft to resolve the issue. For Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats versions SP1 through SP2, apply the patch provided by Microsoft to resolve the issue. For Microsoft Expression Web, apply the patch provided by Microsoft to resolve the issue. For Microsoft Expression Web 2, apply the patch provided by Microsoft to resolve the issue. For Microsoft Groove 2007 versions Gold through SP1, apply the patch provided by Microsoft to resolve the issue. For Microsoft Works 8.5, apply the patch provided by Microsoft to resolve the issue. For Microsoft SQL Server 2000 Reporting Services version SP2, apply the patch provided by Microsoft to resolve the issue. For Microsoft SQL Server 2005 versions SP2 through SP3, apply the patch provided by Microsoft to resolve the issue. For Microsoft Report Viewer 2005 version SP1, apply the patch provided by Microsoft to resolve the issue. For Microsoft Report Viewer 2008 versions Gold through SP1, apply the patch provided by Microsoft to resolve the issue. For Microsoft Forefront Client Security 1.0, apply the patch provided by Microsoft to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2009-2504

Affected Products

.Net Framework

2007 Microsoft Office System

Expression Web

Expression Web 2

Forefront Client Security

Groove 2007

Sql Server

Office

Office 2003

Office Compatibility Pack

Office Excel Viewer

Office Excel Viewer 2003

Office Powerpoint Viewer 2007

Office Project

Office Project 2002

Office Visio

Office Word Viewer

Office Xp

Report Viewer 2005

Report Viewer 2008

Sql Server 2000 Reporting Services

Sql Server 2005

Visio 2002

Windows

Windows Server 2003

Windows Server 2008

Windows Vista

Windows Xp

Word Viewer 2003

Works 8.5

References · 7

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2504 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-062 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2504 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2504 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2009/ms09-062 · Note
• http://us-cert.gov/cas/techalerts/TA09-286A.html · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6282 · Note