PT-2009-4913 · Microsoft · Wordpad+4

Jun Mao + 1 · Published 2009-12-09 · Updated 2019-02-26 · CVE-2009-2506

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office Word versions 2002 SP3 through 2003 SP3 Microsoft Works version 8.5 Office Converter Pack (affected versions not specified) WordPad in Windows versions 2000 SP4 through Server 2003 SP2

Description The issue allows remote attackers to execute arbitrary code via a specially crafted Word file, which triggers a heap-based buffer overflow due to an integer overflow in the text converters. This occurs when a user opens a malicious file, such as a DOC file with an invalid number of property names in the DocumentSummaryInformation stream.

Recommendations For Microsoft Office Word versions 2002 SP3 through 2003 SP3, update to a newer version to mitigate the risk. For Microsoft Works version 8.5, consider disabling the use of text converters until a patch is available. For Office Converter Pack, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For WordPad in Windows versions 2000 SP4 through Server 2003 SP2, restrict access to opening specially crafted Word 97 files to minimize the risk of exploitation.

RCE

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2009-2506

Affected Products

Office Word

Works

Office Converter Pack

Windows

Wordpad

References · 9

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2506 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-073 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2506 · Security Note
• http://securityfocus.com/bid/37216 · Note
• http://us-cert.gov/cas/techalerts/TA09-342A.html · Note
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=834 · Note
• http://support.avaya.com/css/P8/documents/100070184 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5846 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2009/ms09-073 · Note