CVE-2009-3133

Microsoft Office Excel 2002 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via a spreadsheet containing a malformed object that triggers memory corruption, related to "loading Excel records," aka "Excel Document Parsing Memory Corruption Vulnerability."

CVSS v2.0 9.3 HIGH

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.securitytracker.com/id?1023157
http://www.us-cert.gov/cas/techalerts/TA09-314A.html	US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-067
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6265

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microsoft:compatibility_pack_word_excel_powerpoint:2007:sp1::::::
	cpe:2.3:a:microsoft:compatibility_pack_word_excel_powerpoint:2007:sp2::::::
	cpe:2.3:a:microsoft:excel:2002:sp3::::::
	cpe:2.3:a:microsoft:excel:2003:sp3::::::
	cpe:2.3:a:microsoft:excel:2007:sp1::::::
	cpe:2.3:a:microsoft:excel:2007:sp2::::::
	cpe:2.3:a:microsoft:excel_viewer::sp1::::::*
	cpe:2.3:a:microsoft:excel_viewer::sp2::::::*
	cpe:2.3:a:microsoft:excel_viewer:2003:sp3::::::
	cpe:2.3:a:microsoft:office:2004::mac:::::
	cpe:2.3:a:microsoft:office:2008::mac:::::
	cpe:2.3:a:microsoft:open_xml_file_format_converter:::mac:::::*

History

No history.

Information

Published : 2009-11-11 20:30

Updated : 2024-02-28 11:21

NVD link : CVE-2009-3133

Mitre link : CVE-2009-3133

CVE.ORG link : CVE-2009-3133

JSON object : View

Products Affected

microsoft

excel_viewer
office
open_xml_file_format_converter
compatibility_pack_word_excel_powerpoint
excel

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2009-3133", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2009-11-11T20:30:00.280", "references": [{"url": "http://www.securitytracker.com/id?1023157", "source": "secure@microsoft.com"}, {"url": "http://www.us-cert.gov/cas/techalerts/TA09-314A.html", "tags": ["US Government Resource"], "source": "secure@microsoft.com"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-067", "source": "secure@microsoft.com"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6265", "source": "secure@microsoft.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Microsoft Office Excel 2002 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via a spreadsheet containing a malformed object that triggers memory corruption, related to \"loading Excel records,\" aka \"Excel Document Parsing Memory Corruption Vulnerability.\""}, {"lang": "es", "value": "Microsoft Office Excel v2002 SP3, Office v2004 y v2008 para Mac, y Open XML File Format Converter para Mac permite a atacantes remotos ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de una hoja de c\u00e1lculo que contiene un objeto manipulado que lanza una corrupci\u00f3n de memoria, relacionado con \"carga de registros Excel,\" como \"vulnerabilidad de corrupci\u00f3n de memoria en el an\u00e1lisis de documentos Excel\"."}], "lastModified": "2018-10-12T21:52:17.013", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:compatibility_pack_word_excel_powerpoint:2007:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7EB896B5-611E-4457-B438-C6CC937D63FF"}, {"criteria": "cpe:2.3:a:microsoft:compatibility_pack_word_excel_powerpoint:2007:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3F9109ED-34C9-45E0-9E8B-FC05054E0F73"}, {"criteria": "cpe:2.3:a:microsoft:excel:2002:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "896E23B1-AB34-43FF-96F3-BA6ED7F162AF"}, {"criteria": "cpe:2.3:a:microsoft:excel:2003:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CEBB33CD-CACF-4EB8-8B5F-8E1CB8D7A440"}, {"criteria": "cpe:2.3:a:microsoft:excel:2007:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F703901F-AD7C-42E7-BBFA-529A8C510D83"}, {"criteria": "cpe:2.3:a:microsoft:excel:2007:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "273729C3-56BF-454A-8697-473094EA828F"}, {"criteria": "cpe:2.3:a:microsoft:excel_viewer:*:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8E8D1DDD-8996-43A3-9FC7-60539E09CFC4"}, {"criteria": "cpe:2.3:a:microsoft:excel_viewer:*:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D65CAA23-16D8-4AE7-8BC4-F73B1C5F9C3B"}, {"criteria": "cpe:2.3:a:microsoft:excel_viewer:2003:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AE2F0B8B-0600-4324-93A9-07DBE97E1BB8"}, {"criteria": "cpe:2.3:a:microsoft:office:2004:*:mac:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9409A9BD-1E9B-49B8-884F-8FE569D8AA25"}, {"criteria": "cpe:2.3:a:microsoft:office:2008:*:mac:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5BA91840-371C-4282-9F7F-B393F785D260"}, {"criteria": "cpe:2.3:a:microsoft:open_xml_file_format_converter:*:*:mac:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3807A4E4-EB58-47B6-AD98-6ED464DEBA4E"}], "operator": "OR"}]}], "sourceIdentifier": "secure@microsoft.com"}