PT-2009-5455 · Microsoft · Office Excel Viewer+1

Bing Liu · Published 2009-11-11 · Updated 2018-10-12 · CVE-2009-3128

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Microsoft Office Excel versions 2002 SP3 through 2003 SP3 Office Excel Viewer version 2003 SP3

Description: A remote code execution issue exists due to improper parsing of the Excel file format, allowing attackers to execute arbitrary code via a spreadsheet with a malformed record object. This could enable an attacker to take complete control of an affected system, install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations: For Microsoft Office Excel versions 2002 SP3 through 2003 SP3, update to a newer version to mitigate the risk. For Office Excel Viewer version 2003 SP3, update to a newer version to mitigate the risk. As a temporary workaround, consider avoiding the use of specially crafted Excel files that include a malformed record object until a patch is available.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-3128

Affected Products

Office Excel

Office Excel Viewer

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2009-3128 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-067 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3128 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3128 · Note
• http://securitytracker.com/id?1023157 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2009/ms09-067 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6474 · Note
• http://us-cert.gov/cas/techalerts/TA09-314A.html · Note