PT-2009-5458 · Microsoft · Office Excel Viewer+3

Nicolas Joly · Published 2009-11-11 · Updated 2018-10-12 · CVE-2009-3132

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Microsoft Office Excel versions 2002 SP3, 2003 SP3, and 2007 SP1 and SP2 Office 2004 and 2008 for Mac Open XML File Format Converter for Mac Office Excel Viewer versions 2003 SP3, and SP1 and SP2 Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats versions SP1 and SP2

Description: A remote code execution issue exists due to pointer corruption when loading Excel formulas. This could allow remote code execution if a user opens a specially crafted Excel file that includes a malformed formula. An attacker who successfully exploits this issue could take complete control of an affected system, then install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations: For Microsoft Office Excel 2002 SP3, update to a version that fixes the pointer corruption issue. For Microsoft Office Excel 2003 SP3, update to a version that fixes the pointer corruption issue. For Microsoft Office Excel 2007 SP1 and SP2, update to a version that fixes the pointer corruption issue. For Office 2004 and 2008 for Mac, update to a version that fixes the pointer corruption issue. For Open XML File Format Converter for Mac, update to a version that fixes the pointer corruption issue. For Office Excel Viewer 2003 SP3, update to a version that fixes the pointer corruption issue. For Office Excel Viewer SP1 and SP2, update to a version that fixes the pointer corruption issue. For Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2, update to a version that fixes the pointer corruption issue.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-3132

Affected Products

Office Excel

Office Compatibility Pack

Office Excel Viewer

Open Xml File Format Converter For Mac

References · 8

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-067 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-3132 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3132 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6526 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3132 · Note
• http://securitytracker.com/id?1023157 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2009/ms09-067 · Note
• http://us-cert.gov/cas/techalerts/TA09-314A.html · Note