Vulnerability CVE-2009-0561 - CERT Civis.Net

Vulnerability Name:

CVE-2009-0561 (CCN-50789)

Assigned:

2009-06-09

Published:

2009-06-09

Updated:

2018-10-12

Summary:

Integer overflow in Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and SP2; Open XML File Format Converter for Mac; Microsoft Office Excel Viewer 2003 SP3; Microsoft Office Excel Viewer; Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2; and Microsoft Office SharePoint Server 2007 SP1 and SP2 allows remote attackers to execute arbitrary code via an Excel file with a Shared String Table (SST) record with a numeric field that specifies an invalid number of unique strings, which triggers a heap-based buffer overflow, aka "Record Integer Overflow Vulnerability."

CVSS v3 Severity:

10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

9.3 High (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2009-0561

Source: IDEFENSE
Type: UNKNOWN
20090609 Microsoft Excel SST Record Integer Overflow Vulnerability

Source: OSVDB
Type: UNKNOWN
54957

Source: CCN
Type: SA35364
Microsoft Excel Multiple Vulnerabilities

Source: MISC
Type: Vendor Advisory
http://secunia.com/secunia_research/2009-12/

Source: CCN
Type: SECTRACK ID: 1022351
Microsoft Excel Bugs Let Remote Users Execute Arbitrary Code

Source: CCN
Type: ASA-2009-216
MS09-021 Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (969462)

Source: CCN
Type: Microsoft Security Bulletin MS09-021
Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (969462)

Source: CCN
Type: Microsoft Security Bulletin MS09-067
Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (972652)

Source: CCN
Type: Microsoft Security Bulletin MS10-017
Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (980150)

Source: CCN
Type: Microsoft Security Bulletin MS10-038
Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (2027452)

Source: CCN
Type: Microsoft Security Bulletin MS10-057
Vulnerability in Microsoft Office Excel Could Allow Remote Code Execution (2269707)

Source: CCN
Type: OSVDB ID: 54957
Microsoft Office Excel File SST Record Handling String Parsing Overflow

Source: BUGTRAQ
Type: UNKNOWN
20090609 Secunia Research: Microsoft Excel String Parsing Integer Overflow Vulnerability

Source: BID
Type: UNKNOWN
35245

Source: CCN
Type: BID-35245
Microsoft Excel Malformed Shared String Table Record Integer Overflow Vulnerability

Source: SECTRACK
Type: UNKNOWN
1022351

Source: CERT
Type: US Government Resource
TA09-160A

Source: VUPEN
Type: Vendor Advisory
ADV-2009-1540

Source: MS
Type: UNKNOWN
MS09-021

Source: XF
Type: UNKNOWN
excel-record-overflow(50789)

Source: CCN
Type: iDefense PUBLIC ADVISORY: 06.09.09
Microsoft Excel SST Record Integer Overflow Vulnerability

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:5925

Vulnerable Configuration:

Configuration 1:

cpe:/a:microsoft:office:2004:*:mac:*:*:*:*:*

OR cpe:/a:microsoft:office:2008:*:mac:*:*:*:*:*

OR cpe:/a:microsoft:office:xp:sp3:*:*:*:*:*:*

OR cpe:/a:microsoft:office_compatibility_pack_for_word_excel_ppt_2007:*:sp1:*:*:*:*:*:*

OR cpe:/a:microsoft:office_compatibility_pack_for_word_excel_ppt_2007:*:sp2:*:*:*:*:*:*

OR cpe:/a:microsoft:office_excel:2000:sp3:*:*:*:*:*:*

OR cpe:/a:microsoft:office_excel:2003:sp3:*:*:*:*:*:*

OR cpe:/a:microsoft:office_excel:2007:sp1:*:*:*:*:*:*

OR cpe:/a:microsoft:office_excel:2007:sp2:*:*:*:*:*:*

OR cpe:/a:microsoft:office_excel_viewer:*:*:*:*:*:*:*:*

OR cpe:/a:microsoft:office_excel_viewer:2003:sp3:*:*:*:*:*:*

OR cpe:/a:microsoft:office_sharepoint_server:2007:sp1:x32:*:*:*:*:*

OR cpe:/a:microsoft:office_sharepoint_server:2007:sp1:x64:*:*:*:*:*

OR cpe:/a:microsoft:office_sharepoint_server:2007:sp2:x32:*:*:*:*:*

OR cpe:/a:microsoft:office_sharepoint_server:2007:sp2:x64:*:*:*:*:*

OR cpe:/a:microsoft:open_xml_file_format_converter:*:*:mac:*:*:*:*:*

Configuration CCN 1:

cpe:/a:microsoft:excel:2000:sp3:*:*:*:*:*:*

OR cpe:/a:microsoft:excel:2002:sp3:*:*:*:*:*:*

OR cpe:/a:microsoft:excel_viewer:2003:sp3:*:*:*:*:*:*

OR cpe:/a:microsoft:excel_viewer:*:*:*:*:*:*:*:*

OR cpe:/a:microsoft:office_compatibility_pack:2007:sp1:*:*:*:*:*:*

OR cpe:/a:microsoft:excel:2007:sp1:*:*:*:*:*:*

OR cpe:/a:microsoft:excel:2003:sp3:*:*:*:*:*:*

OR cpe:/a:microsoft:sharepoint_server:2007:sp1:x64:*:*:*:*:*

OR cpe:/a:microsoft:sharepoint_server:2007:sp1:x32:*:*:*:*:*

OR cpe:/a:microsoft:office_compatibility_pack:2007:sp2:*:*:*:*:*:*

OR cpe:/a:microsoft:excel:2007:sp2:*:*:*:*:*:*

OR cpe:/a:microsoft:sharepoint_server:2007:sp2:x32:*:*:*:*:*

OR cpe:/a:microsoft:sharepoint_server:2007:sp2:x64:*:*:*:*:*

OR cpe:/a:microsoft:office:2004::~~~mac_os~~:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.mitre.oval:def:5925	V	Record Integer Overflow Vulnerability	2014-06-30