Executive Summary
| Summary | |
|---|---|
| Title | Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (972652) |
| Informations | |||
|---|---|---|---|
| Name | MS09-067 | First vendor Publication | 2009-11-10 |
| Vendor | Microsoft | Last vendor Modification | 2009-11-10 |
| Severity (Vendor) | Important | Revision | 1.0 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 9.3 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Revision Note: V1.0 (November 10, 2009): Bulletin published.Summary: This security update resolves several privately reported vulnerabilities in Microsoft Office Excel. The vulnerabilities could allow remote code execution if a user opens a specially crafted Excel file. An attacker who successfully exploited any of these vulnerabilities could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 88 % | CWE-94 | Failure to Control Generation of Code ('Code Injection') |
| 12 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:5878 | |||
| Oval ID: | oval:org.mitre.oval:def:5878 | ||
| Title: | Excel Field Sanitization Vulnerability | ||
| Description: | Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 do not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a spreadsheet with a malformed record object, aka "Excel Field Sanitization Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2009-3134 | Version: | 8 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Microsoft Excel 2002 Microsoft Excel 2003 Microsoft Excel 2007 Microsoft Office Excel Viewer 2003 Microsoft Office Excel Viewer Microsoft Office Compatibility Pack |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:6137 | |||
| Oval ID: | oval:org.mitre.oval:def:6137 | ||
| Title: | Excel Document Parsing Heap Overflow Vulnerability | ||
| Description: | Heap-based buffer overflow in Microsoft Office Excel 2002 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via a spreadsheet containing a malformed Binary File Format (aka BIFF) record that triggers memory corruption, aka "Excel Document Parsing Heap Overflow Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2009-3130 | Version: | 3 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 | Product(s): | Microsoft Excel 2002 |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:6146 | |||
| Oval ID: | oval:org.mitre.oval:def:6146 | ||
| Title: | Excel Cache Memory Corruption Vulnerability | ||
| Description: | Microsoft Office Excel 2002 SP3 and 2003 SP3, Office 2004 and 2008 for Mac, Open XML File Format Converter for Mac, and Office Excel Viewer 2003 SP3 do not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "Excel Cache Memory Corruption Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2009-3127 | Version: | 6 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Microsoft Excel 2002 Microsoft Excel 2003 Microsoft Office Excel Viewer 2003 |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:6265 | |||
| Oval ID: | oval:org.mitre.oval:def:6265 | ||
| Title: | Excel Document Parsing Memory Corruption Vulnerability | ||
| Description: | Microsoft Office Excel 2002 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via a spreadsheet containing a malformed object that triggers memory corruption, related to "loading Excel records," aka "Excel Document Parsing Memory Corruption Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2009-3133 | Version: | 3 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 | Product(s): | Microsoft Excel 2002 |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:6474 | |||
| Oval ID: | oval:org.mitre.oval:def:6474 | ||
| Title: | Excel SxView Memory Corruption Vulnerability | ||
| Description: | Microsoft Office Excel 2002 SP3 and 2003 SP3, and Office Excel Viewer 2003 SP3, does not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a spreadsheet with a malformed record object, aka "Excel SxView Memory Corruption Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2009-3128 | Version: | 6 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Microsoft Excel 2002 Microsoft Excel 2003 Microsoft Office Excel Viewer 2003 |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:6518 | |||
| Oval ID: | oval:org.mitre.oval:def:6518 | ||
| Title: | Excel Formula Parsing Memory Corruption Vulnerability | ||
| Description: | Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allow remote attackers to execute arbitrary code via a spreadsheet with a crafted formula embedded in a cell, aka "Excel Formula Parsing Memory Corruption Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2009-3131 | Version: | 8 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Microsoft Excel 2002 Microsoft Excel 2003 Microsoft Excel 2007 Microsoft Office Excel Viewer 2003 Microsoft Office Excel Viewer Microsoft Office Compatibility Pack |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:6521 | |||
| Oval ID: | oval:org.mitre.oval:def:6521 | ||
| Title: | Excel Featheader Record Memory Corruption Vulnerability | ||
| Description: | Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset, aka "Excel Featheader Record Memory Corruption Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2009-3129 | Version: | 8 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Microsoft Excel 2002 Microsoft Excel 2003 Microsoft Excel 2007 Microsoft Office Excel Viewer 2003 Microsoft Office Excel Viewer Microsoft Office Compatibility Pack |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:6526 | |||
| Oval ID: | oval:org.mitre.oval:def:6526 | ||
| Title: | Excel Index Parsing Vulnerability | ||
| Description: | Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allow remote attackers to execute arbitrary code via a spreadsheet containing a malformed formula, related to a "pointer corruption" issue, aka "Excel Index Parsing Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2009-3132 | Version: | 8 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Microsoft Excel 2002 Microsoft Excel 2003 Microsoft Excel 2007 Microsoft Office Excel Viewer 2003 Microsoft Office Excel Viewer Microsoft Office Compatibility Pack |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 2 | |
| Application | 4 | |
| Application | 3 | |
| Application | 2 | |
| Application | 1 |
ExploitDB Exploits
| id | Description |
|---|---|
| 2010-09-25 | Microsoft Excel Malformed FEATHEADER Record Vulnerability |
| 2010-08-21 | MS Excel Malformed FEATHEADER Record Exploit (MS09-067) |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-11-11 | Name : Microsoft Office Excel Multiple Vulnerabilities (972652) File : nvt/secpod_ms09-067.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 59866 | Microsoft Office Excel Document Record Parsing Memory Corruption |
| 59864 | Microsoft Office Excel Malformed Record Object Sanitization Failure Arbitrary... |
| 59863 | Microsoft Office Excel Formula Handling Pointer Corruption Arbitrary Code Exe... |
| 59862 | Microsoft Office Excel Cell Embeded Formula Parsing Memory Corruption |
| 59861 | Microsoft Office Excel BIFF Record Parsing Overflow |
| 59860 | Microsoft Office Excel BIFF File FEATHEADER cbHdrData Size Element Handling M... Excel contains a flaw that may allow a context-dependent attacker to execute arbitrary code. The issue is triggered by a specially crafted Excel document that contains a malformed FEATHEADER object. |
| 59859 | Microsoft Office Excel SxView Record Handling Memory Corruption |
| 59858 | Microsoft Office Excel Malformed PivotCache Stream Handling Memory Corruption |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2019-12-03 | Microsoft Office Excel row record buffer overflow attempt RuleID : 52066 - Revision : 1 - Type : FILE-OFFICE |
| 2019-12-03 | Microsoft Office Excel row record buffer overflow attempt RuleID : 52065 - Revision : 1 - Type : FILE-OFFICE |
| 2014-11-16 | Microsoft Office Excel SXDB record memory corruption attempt RuleID : 31436 - Revision : 2 - Type : FILE-OFFICE |
| 2014-11-16 | Microsoft Office Excel SXDB record memory corruption attempt RuleID : 31435 - Revision : 2 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel SXDB memory corruption attempt RuleID : 26177 - Revision : 4 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel SXDB memory corruption attempt RuleID : 26176 - Revision : 6 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel file SxView record exploit attempt RuleID : 23543 - Revision : 4 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel integer field in row record improper validation remote... RuleID : 23542 - Revision : 4 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel SXDB memory corruption RuleID : 21503 - Revision : 10 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel ptg index parsing code execution attempt RuleID : 16553 - Revision : 11 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel FeatHdr BIFF record remote code execution attempt RuleID : 16241 - Revision : 12 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel file Window/Pane record exploit attempt RuleID : 16240 - Revision : 14 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel file SxView record exploit attempt RuleID : 16236 - Revision : 14 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel file SXDB record exploit attempt RuleID : 16235 - Revision : 13 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel oversized ptgFuncVar cparams value buffer overflow att... RuleID : 16233 - Revision : 12 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Excel oversized ib memory corruption attempt RuleID : 16230 - Revision : 9 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel oversized ib memory corruption attempt RuleID : 16229 - Revision : 14 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel malformed StartObject record arbitrary code execution ... RuleID : 16228 - Revision : 9 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Office Excel integer field in row record improper validation remote... RuleID : 16226 - Revision : 11 - Type : FILE-OFFICE |
Metasploit Database
| id | Description |
|---|---|
| 2009-11-10 | MS09-067 Microsoft Excel Malformed FEATHEADER Record Vulnerability |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2010-10-20 | Name : An application installed on the remote Mac OS X host is affected by multiple ... File : macosx_ms_office_nov2009.nasl - Type : ACT_GATHER_INFO |
| 2009-11-10 | Name : Arbitrary code can be executed on the remote host through opening a Microsoft... File : smb_nt_ms09-067.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2020-05-23 13:17:13 |
|
| 2016-04-26 22:58:00 |
|
| 2014-11-16 21:25:21 |
|
| 2014-02-17 11:46:24 |
|
| 2014-01-19 21:30:24 |
|
