Vulnerabilities > CVE-2009-0224 - Code Injection vulnerability in Microsoft products
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
Microsoft Office PowerPoint 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; PowerPoint Viewer 2003 and 2007 SP1 and SP2; PowerPoint in Microsoft Office 2004 for Mac and 2008 for Mac; Open XML File Format Converter for Mac; Microsoft Works 8.5 and 9.0; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 do not properly validate PowerPoint files, which allows remote attackers to execute arbitrary code via multiple crafted BuildList records that include ChartBuild containers, which triggers memory corruption, aka "Memory Corruption Vulnerability."
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Leverage Executable Code in Non-Executable Files An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
- Manipulating User-Controlled Variables This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An attacker can override environment variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the attacker can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.
Msbulletin
| bulletin_id | MS09-017 |
| bulletin_url | |
| date | 2009-05-12T00:00:00 |
| impact | Remote Code Execution |
| knowledgebase_id | 967340 |
| knowledgebase_url | |
| severity | Critical |
| title | Vulnerabilities in Microsoft Office PowerPoint Could Allow Remote Code Execution |
Nessus
NASL family Windows : Microsoft Bulletins NASL id SMB_NT_MS09-017.NASL description The remote Windows host is running a version of Microsoft PowerPoint, PowerPoint Viewer, or PowerPoint Converter that is affected by multiple vulnerabilities. If an attacker can trick a user on the affected host into opening a specially crafted PowerPoint file, he could leverage these issues to execute arbitrary code subject to the user last seen 2020-06-01 modified 2020-06-02 plugin id 38742 published 2009-05-13 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/38742 title MS09-017: Vulnerabilities in Microsoft Office PowerPoint Could Allow Remote Code Execution (967340) code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(38742); script_version("1.40"); script_cvs_date("Date: 2019/12/13"); script_cve_id( "CVE-2009-0220", "CVE-2009-0221", "CVE-2009-0222", "CVE-2009-0223", "CVE-2009-0224", "CVE-2009-0225", "CVE-2009-0226", "CVE-2009-0227", "CVE-2009-0556", "CVE-2009-1128", "CVE-2009-1129", "CVE-2009-1130", "CVE-2009-1131", "CVE-2009-1137" ); script_bugtraq_id( 34351, 34831, 34833, 34834, 34835, 34837, 34839, 34840, 34841, 34876, 34879, 34880, 34881, 34882 ); script_xref(name:"CERT", value:"627331"); script_xref(name:"MSFT", value:"MS09-017"); script_xref(name:"MSKB", value:"957781"); script_xref(name:"MSKB", value:"957784"); script_xref(name:"MSKB", value:"957789"); script_xref(name:"MSKB", value:"957790"); script_xref(name:"MSKB", value:"969615"); script_xref(name:"MSKB", value:"969618"); script_xref(name:"MSKB", value:"970059"); script_name(english:"MS09-017: Vulnerabilities in Microsoft Office PowerPoint Could Allow Remote Code Execution (967340)"); script_summary(english:"Checks version of PowerPoint"); script_set_attribute( attribute:"synopsis", value: "Arbitrary code can be executed on the remote host through Microsoft PowerPoint." ); script_set_attribute( attribute:"description", value: "The remote Windows host is running a version of Microsoft PowerPoint, PowerPoint Viewer, or PowerPoint Converter that is affected by multiple vulnerabilities. If an attacker can trick a user on the affected host into opening a specially crafted PowerPoint file, he could leverage these issues to execute arbitrary code subject to the user's privileges." ); # https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2009/ms09-017 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?514f3bd5"); script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-09-019/"); script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-09-020/"); script_set_attribute( attribute:"solution", value: "Microsoft has released a set of patches for PowerPoint 2000, 2002, 2003, and 2007, PowerPoint Viewer 2003 and 2007, as well as the Microsoft Office Compatibility Pack." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_cwe_id(94, 119, 189); script_set_attribute(attribute:"vuln_publication_date", value:"2009/04/02"); script_set_attribute(attribute:"patch_publication_date", value:"2009/05/12"); script_set_attribute(attribute:"plugin_publication_date", value:"2009/05/13"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Windows : Microsoft Bulletins"); script_copyright(english:"This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("smb_nt_ms02-031.nasl", "office_installed.nasl", "ms_bulletin_checks_possible.nasl"); script_require_keys("SMB/MS_Bulletin_Checks/Possible"); script_require_ports(139, 445, 'Host/patch_management_checks'); exit(0); } include("smb_hotfixes_fcheck.inc"); include("smb_hotfixes.inc"); include("misc_func.inc"); include("audit.inc"); get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible"); bulletin = 'MS09-017'; kbs = make_list("957781", "957784", "957789", "957790", "969615", "969618", "970059"); if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE); # PowerPoint. info = ""; pp_patched = FALSE; vuln = 0; kb = ""; installs = get_kb_list("SMB/Office/PowerPoint/*/ProductPath"); if (!isnull(installs)) { foreach install (keys(installs)) { version = install - 'SMB/Office/PowerPoint/' - '/ProductPath'; path = installs[install]; if (isnull(path)) path = "n/a"; ver = split(version, sep:'.', keep:FALSE); for (i=0; i<max_index(ver); i++) ver[i] = int(ver[i]); # PowerPoint 2007. if ( ver[0] == 12 && ver[1] == 0 && ( ver[2] < 6500 || (ver[2] == 6500 && ver[3] < 5000) ) ) { office_sp = get_kb_item("SMB/Office/2007/SP"); if (!isnull(office_sp) && (office_sp == 1 || office_sp == 2)) { vuln++; kb = "957789"; info = '\n Product : PowerPoint 2007' + '\n File : ' + path + '\n Installed version : ' + version + '\n Fixed version : 12.0.6500.5000\n'; hotfix_add_report(info, bulletin:bulletin, kb:kb); } } # PowerPoint 2003. else if (ver[0] == 11 && ver[1] == 0 && ver[2] < 8307) { office_sp = get_kb_item("SMB/Office/2003/SP"); if (!isnull(office_sp) && office_sp == 3) { vuln++; kb = "957784"; info = '\n Product : PowerPoint 2003' + '\n File : ' + path + '\n Installed version : ' + version + '\n Fixed version : 11.0.8307.0\n'; hotfix_add_report(info, bulletin:bulletin, kb:kb); } } # PowerPoint 2002. else if (ver[0] == 10 && ver[1] == 0 && ver[2] < 6853) { office_sp = get_kb_item("SMB/Office/XP/SP"); if (!isnull(office_sp) && office_sp == 3) { vuln++; kb = "957781"; info = '\n Product : PowerPoint 2002' + '\n File : ' + path + '\n Installed version : ' + version + '\n Fixed version : 10.0.6853.0\n'; hotfix_add_report(info, bulletin:bulletin, kb:kb); } } # PowerPoint 2000 - fixed in 9.0.0.8978 else if (ver[0] == 9 && ver[1] == 0 && ver[2] == 0 && ver[3] < 8978) { office_sp = get_kb_item("SMB/Office/2000/SP"); if (!isnull(office_sp) && office_sp == 3) { vuln++; kb = "957790"; info = '\n Product : PowerPoint 2000' + '\n File : ' + path + '\n Installed version : ' + version + '\n Fixed version : 9.0.0.8978\n'; hotfix_add_report(info, bulletin:bulletin, kb:kb); } } } } if (!vuln) pp_patched = TRUE; # PowerPoint Viewer. installs = get_kb_list("SMB/Office/PowerPointViewer/*/ProductPath"); if (!isnull(installs) && !pp_patched) { version = install - 'SMB/Office/PowerPointViewer/' - '/ProductPath'; path = installs[install]; if (isnull(path)) path = 'n/a'; ver = split(version, sep:'.', keep:FALSE); for (i=0; i<max_index(ver); i++) ver[i] = int(ver[i]); # PowerPoint Viewer 2007. if ( ver[0] == 12 && ver[1] == 0 && ( ver[2] < 6502 || (ver[2] == 6502 && ver[3] < 5000) ) ) { vuln++; kb = "970059"; info = '\n Product : PowerPoint Viewer 2007' + '\n File : ' + path + '\n Installed version : ' + version + '\n Fixed version : 12.0.6502.5000\n'; hotfix_add_report(info, bulletin:bulletin, kb:kb); } # Office PowerPoint Viewer 2003. else if (ver[0] == 11 && ver[1] == 0 && ver[2] < 8305) { kb = "969615"; info = '\n Product : Office PowerPoint Viewer 2003' + '\n File : ' + path + '\n Installed version : ' + version + '\n Fixed version : 11.0.8305.0\n'; hotfix_add_report(info, bulletin:bulletin, kb:kb); } } # PowerPoint Converter. installs = get_kb_list("SMB/Office/PowerPointCnv/*/ProductPath"); if (!isnull(installs)) { foreach install (keys(installs)) { version = install - 'SMB/Office/PowerPointCnv/' - '/ProductPath'; path = installs[install]; if (isnull(path)) path = 'n/a'; ver = split(version, sep:'.', keep:FALSE); for (i=0; i<max_index(ver); i++) ver[i] = int(ver[i]); # PowerPoint 2007 converter. if ( ver[0] == 12 && ver[1] == 0 && ( ver[2] < 6500 || (ver[2] == 6500 && ver[3] < 5000) ) ) { vuln++; kb = "969618"; info = '\n Product : PowerPoint 2007 Converter' + '\n File : ' + path + '\n Installed version : ' + version + '\n Fixed version : 12.0.6500.5000\n'; hotfix_add_report(info, kb:kb, bulletin:bulletin); } } } if (vuln) { set_kb_item(name:"SMB/Missing/"+bulletin, value:TRUE); hotfix_security_hole(); exit(0); } else audit(AUDIT_HOST_NOT, 'affected');NASL family MacOS X Local Security Checks NASL id MACOSX_MS_OFFICE_JUN2009.NASL description The remote Mac OS X host is running a version of Microsoft Office that is affected by several vulnerabilities. If an attacker can trick a user on the affected host into opening a specially crafted Excel, PowerPoint, or Word file, these issues could be leveraged to execute arbitrary code subject to the user last seen 2019-12-14 modified 2010-10-20 plugin id 50062 published 2010-10-20 reporter This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/50062 title MS09-017 / MS09-021 / MS09-027: Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (967340 / 969462 / 969514) (Mac OS X) code #TRUSTED 3e3f269fc961b6a05759571c09b4b381940164e9ede782e5c3a9a49d4e12c61d0a98ad38db0270182c3ed6e584cc40cd442be95e89c53b9c92aa35347de6ea16dac17dd1876a116601a66c912864b1da4d25ee4ba4a2281472e35b3175c9af529a3854cf08e7024f0bbed16a0df6e9138239297a12b7099b9cc2e6c740916952ec49591770394440db3eea92d7cec0c27d619c9be9d233d0b0642e28fed26a7ffa40f4b2f83d99fc539cfe76d5e7ebbb64d668d32365e17d9d110b4cac0c8ae7b957e92345fdca13b1cbecc5b86cf4e167ee58f1cce9078f212b7f195ccc2dc81dcaad12f3fa7b09dcd0163e7140a230273ac7a9d345d45d6fe50bd50ea1e9c9fb4ffe04bf5c93c9068b3ab9a9b0bbc6ec6a9ef64b99b0a36f814ccc7657044dbf3e70a0417101465b94bf1ff6396f275de6d1510e442298de29305a3f2c69a40f880f7ff0f79706cbf90528974bbae297e3a88a89c0a7d638de102e73667530b615feba0241b59080a3daecd752f88294a53aba95960093d15a5be0fe8159243287c9fdde44067bb30a95d59054d6c95ab126e93fa5fa753941bcacd81c2d2bfe6f7199bffc313d698e8351082df89be11a94577b7798236aea8f05a308fe30134df052af9e8c8f745ada072293e200da40e9acdfb24822e36ec1ae823ea1af4a1c7b7afda5d18570fca395cbe433be84f0be1c6b27955c0d8caf77d3ae9baa # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(50062); script_version("1.20"); script_set_attribute(attribute:"plugin_modification_date", value:"2019/12/13"); script_cve_id( "CVE-2009-0224", "CVE-2009-0549", "CVE-2009-0557", "CVE-2009-0558", "CVE-2009-0560", "CVE-2009-0561", "CVE-2009-0563", "CVE-2009-0565" ); script_bugtraq_id(34879, 35215, 35241, 35242, 35244, 35245, 35188, 35190); script_xref(name:"MSFT", value:"MS09-017"); script_xref(name:"MSFT", value:"MS09-021"); script_xref(name:"MSFT", value:"MS09-027"); script_xref(name:"MSKB", value:"967340"); script_xref(name:"MSKB", value:"969462"); script_xref(name:"MSKB", value:"969514"); script_xref(name:"MSKB", value:"969661"); script_xref(name:"MSKB", value:"971822"); script_xref(name:"MSKB", value:"971824"); script_name(english:"MS09-017 / MS09-021 / MS09-027: Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (967340 / 969462 / 969514) (Mac OS X)"); script_summary(english:"Check version of Microsoft Office"); script_set_attribute(attribute:"synopsis", value: "An application installed on the remote Mac OS X host is affected by multiple remote code execution vulnerabilities."); script_set_attribute(attribute:"description", value: "The remote Mac OS X host is running a version of Microsoft Office that is affected by several vulnerabilities. If an attacker can trick a user on the affected host into opening a specially crafted Excel, PowerPoint, or Word file, these issues could be leveraged to execute arbitrary code subject to the user's privileges."); script_set_attribute(attribute:"see_also", value:"http://technet.microsoft.com/en-us/security/bulletin/ms09-017"); script_set_attribute(attribute:"see_also", value:"http://technet.microsoft.com/en-us/security/bulletin/ms09-021"); script_set_attribute(attribute:"see_also", value:"http://technet.microsoft.com/en-us/security/bulletin/ms09-027"); script_set_attribute(attribute:"solution", value: "Microsoft has released a set of patches for Office 2004 for Mac, Office 2008 for Mac, and Open XML File Format Converter for Mac."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_cwe_id(94); script_cwe_id(119); script_set_attribute(attribute:"vuln_publication_date", value:"2009/06/09"); script_set_attribute(attribute:"patch_publication_date", value:"2009/06/09"); script_set_attribute(attribute:"plugin_publication_date", value:"2010/10/20"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office:2004::mac"); script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office:2008::mac"); script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:open_xml_file_format_converter:::mac"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"MacOS X Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/MacOSX/packages", "Host/uname"); exit(0); } include("misc_func.inc"); include("ssh_func.inc"); include("macosx_func.inc"); if(sshlib::get_support_level() >= sshlib::SSH_LIB_SUPPORTS_COMMANDS) enable_ssh_wrappers(); else disable_ssh_wrappers(); function exec(cmd) { local_var buf, ret; if (islocalhost()) buf = pread(cmd:"/bin/bash", argv:make_list("bash", "-c", cmd)); else { ret = ssh_open_connection(); if (!ret) exit(1, "ssh_open_connection() failed."); buf = ssh_cmd(cmd:cmd); ssh_close_connection(); } return buf; } packages = get_kb_item("Host/MacOSX/packages"); if (!packages) exit(1, "The 'Host/MacOSX/packages' KB item is missing."); uname = get_kb_item("Host/uname"); if (!uname) exit(1, "The 'Host/uname' KB item is missing."); if (!egrep(pattern:"Darwin.*", string:uname)) exit(1, "The host does not appear to be using the Darwin sub-system."); # Gather version info. info = ''; installs = make_array(); prod = 'Office 2008 for Mac'; plist = "/Applications/Microsoft Office 2008/Office/MicrosoftComponentPlugin.framework/Versions/12/Resources/Info.plist"; cmd = 'cat \'' + plist + '\' | ' + 'grep -A 1 CFBundleShortVersionString | ' + 'tail -n 1 | ' + 'sed \'s/.*string>\\(.*\\)<\\/string>.*/\\1/g\''; version = exec(cmd:cmd); if (version && version =~ "^[0-9]+\.") { version = chomp(version); if (version !~ "^12\.") exit(1, "Failed to get the version for "+prod+" - '"+version+"'."); installs[prod] = version; ver = split(version, sep:'.', keep:FALSE); for (i=0; i<max_index(ver); i++) ver[i] = int(ver[i]); fixed_version = '12.1.9'; fix = split(fixed_version, sep:'.', keep:FALSE); for (i=0; i<max_index(fix); i++) fix[i] = int(fix[i]); for (i=0; i<max_index(fix); i++) if ((ver[i] < fix[i])) { info += '\n Product : ' + prod + '\n Installed version : ' + version + '\n Fixed version : ' + fixed_version + '\n'; break; } else if (ver[i] > fix[i]) break; } prod = 'Office 2004 for Mac'; cmd = GetCarbonVersionCmd(file:"Microsoft Component Plugin", path:"/Applications/Microsoft Office 2004/Office"); version = exec(cmd:cmd); if (version && version =~ "^[0-9]+\.") { version = chomp(version); if (version !~ "^11\.") exit(1, "Failed to get the version for "+prod+" - '"+version+"'."); installs[prod] = version; ver = split(version, sep:'.', keep:FALSE); for (i=0; i<max_index(ver); i++) ver[i] = int(ver[i]); fixed_version = '11.5.5'; fix = split(fixed_version, sep:'.', keep:FALSE); for (i=0; i<max_index(fix); i++) fix[i] = int(fix[i]); for (i=0; i<max_index(fix); i++) if ((ver[i] < fix[i])) { info += '\n Product : ' + prod + '\n Installed version : ' + version + '\n Fixed version : ' + fixed_version + '\n'; break; } else if (ver[i] > fix[i]) break; } prod = 'Open XML File Format Converter for Mac'; plist = "/Applications/Open XML Converter.app/Contents/Info.plist"; cmd = 'cat \'' + plist + '\' | ' + 'grep -A 1 CFBundleShortVersionString | ' + 'tail -n 1 | ' + 'sed \'s/.*string>\\(.*\\)<\\/string>.*/\\1/g\''; version = exec(cmd:cmd); if (version && version =~ "^[0-9]+\.") { version = chomp(version); installs[prod] = version; ver = split(version, sep:'.', keep:FALSE); for (i=0; i<max_index(ver); i++) ver[i] = int(ver[i]); fixed_version = '1.0.3'; fix = split(fixed_version, sep:'.', keep:FALSE); for (i=0; i<max_index(fix); i++) fix[i] = int(fix[i]); for (i=0; i<max_index(fix); i++) if ((ver[i] < fix[i])) { info += '\n Product : ' + prod + '\n Installed version : ' + version + '\n Fixed version : ' + fixed_version + '\n'; break; } else if (ver[i] > fix[i]) break; } # Report findings. if (info) { gs_opt = get_kb_item("global_settings/report_verbosity"); if (gs_opt && gs_opt != 'Quiet') security_hole(port:0, extra:info); else security_hole(0); exit(0); } else { if (max_index(keys(installs)) == 0) exit(0, "Office for Mac / Open XML File Format Converter is not installed."); else { msg = 'The host has '; foreach prod (sort(keys(installs))) msg += prod + ' ' + installs[prod] + ' and '; msg = substr(msg, 0, strlen(msg)-1-strlen(' and ')); msg += ' installed and thus is not affected.'; exit(0, msg); } }
Oval
| accepted | 2014-06-30T04:11:12.998-04:00 | ||||||||||||||||||||||||||||
| class | vulnerability | ||||||||||||||||||||||||||||
| contributors |
| ||||||||||||||||||||||||||||
| definition_extensions |
| ||||||||||||||||||||||||||||
| description | Microsoft Office PowerPoint 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; PowerPoint Viewer 2003 and 2007 SP1 and SP2; PowerPoint in Microsoft Office 2004 for Mac and 2008 for Mac; Open XML File Format Converter for Mac; Microsoft Works 8.5 and 9.0; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 do not properly validate PowerPoint files, which allows remote attackers to execute arbitrary code via multiple crafted BuildList records that include ChartBuild containers, which triggers memory corruption, aka "Memory Corruption Vulnerability." | ||||||||||||||||||||||||||||
| family | windows | ||||||||||||||||||||||||||||
| id | oval:org.mitre.oval:def:6023 | ||||||||||||||||||||||||||||
| status | accepted | ||||||||||||||||||||||||||||
| submitted | 2009-05-12T09:28:00 | ||||||||||||||||||||||||||||
| title | Memory Corruption Vulnerability | ||||||||||||||||||||||||||||
| version | 23 |
Seebug
bulletinFamily exploit description CVE-2009-0220 CVE-2009-0221 CVE-2009-0222 CVE-2009-0223 CVE-2009-0224 CVE-2009-0225 CVE-2009-0226 CVE-2009-0227 CVE-2009-1128 CVE-2009-1129 CVE-2009-1130 CVE-2009-1131 CVE-2009-1137 Microsoft PowerPoint存在多个安全漏洞，它可以被恶意利用。 1 ）两个边界错误处理某些原子可以被利用来造成基于堆栈的缓冲区溢出通过一个特制的PowerPoint文件。 2 ）时出现错误剖析段落格式的数据可以被用来腐败内存通过特制的PowerPoint 4.0文件。 3 ）一个整数溢出错误解析无效记录类型可以利用腐败的记忆通过特制的PowerPoint文件。 4 ）时发生错误解析名单记录可以被用来腐败内存通过特制的PowerPoint文件。 5 ）时发生错误解析某些畸形结构价值观可以利用腐败的记忆通过特制的PowerPoint文件。 6 ）多错误剖析声音数据时，可以利用腐败的记忆通过特制的PowerPoint 4.0和95个文件。 成功利用这些漏洞允许执行任意代码。 Microsoft Office 2000 Microsoft Office 2003 Professional Edition Microsoft Office 2003 Small Business Edition Microsoft Office 2003 Standard Edition Microsoft Office 2003 Student and Teacher Edition Microsoft Office 2004 for Mac Microsoft Office 2007 Microsoft Office 2008 for Mac Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Microsoft Office PowerPoint 2007 Microsoft Office PowerPoint Viewer 2003 Microsoft Office PowerPoint Viewer 2007 Microsoft Office XP Microsoft Open XML File Format Converter for Mac Microsoft PowerPoint 2000 Microsoft PowerPoint 2002 Microsoft Powerpoint 2003 Microsoft Works 8.x Microsoft Works 9.x Microsoft Office PowerPoint 2000 SP3: <a href="http://www.microsoft.com/downloads/details.aspx?familyid=f443312a-ac74-4ebc-a4ac-7a756aa67894" target="_blank">http://www.microsoft.com/downloads/de...=f443312a-ac74-4ebc-a4ac-7a756aa67894</a> Microsoft Office PowerPoint 2002 SP3: <a href="http://www.microsoft.com/downloads/details.aspx?familyid=a24ec7ab-c1c7-4ddb-8b6e-107f1af67f49" target="_blank">http://www.microsoft.com/downloads/de...=a24ec7ab-c1c7-4ddb-8b6e-107f1af67f49</a> Microsoft Office PowerPoint 2003 SP3: <a href="http://www.microsoft.com/downloads/details.aspx?familyid=ccfa978b-3340-40db-a45d-c880ba36b106" target="_blank">http://www.microsoft.com/downloads/de...=ccfa978b-3340-40db-a45d-c880ba36b106</a> Microsoft Office PowerPoint 2007 SP1: <a href="http://www.microsoft.com/downloads/details.aspx?familyid=11f8380f-ffb6-4c22-a89c-3dc55d0f9834" target="_blank">http://www.microsoft.com/downloads/de...=11f8380f-ffb6-4c22-a89c-3dc55d0f9834</a> Microsoft Office PowerPoint 2007 SP2: <a href="http://www.microsoft.com/downloads/details.aspx?familyid=11f8380f-ffb6-4c22-a89c-3dc55d0f9834" target="_blank">http://www.microsoft.com/downloads/de...=11f8380f-ffb6-4c22-a89c-3dc55d0f9834</a> Microsoft Office 2004 for Mac: According to the vendor, patches are still in development and will be released at a later stage. Microsoft Office 2008 for Mac: According to the vendor, patches are still in development and will be released at a later stage. Open XML File Format Converter for Mac: According to the vendor, patches are still in development and will be released at a later stage. PowerPoint Viewer 2003: <a href="http://www.microsoft.com/downloads/details.aspx?familyid=6a57e6ed-bd24-406f-87bb-117391e083e0" target="_blank">http://www.microsoft.com/downloads/de...=6a57e6ed-bd24-406f-87bb-117391e083e0</a> PowerPoint Viewer 2007 SP1/SP2: <a href="http://www.microsoft.com/downloads/details.aspx?familyid=141b8338-5c52-4326-a9e4-d2f2d8940d9c" target="_blank">http://www.microsoft.com/downloads/de...=141b8338-5c52-4326-a9e4-d2f2d8940d9c</a> Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1: <a href="http://www.microsoft.com/downloads/details.aspx?familyid=e1d3a4c3-538a-4f98-8d60-250803a80e2a" target="_blank">http://www.microsoft.com/downloads/de...=e1d3a4c3-538a-4f98-8d60-250803a80e2a</a> Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2: <a href="http://www.microsoft.com/downloads/details.aspx?familyid=e1d3a4c3-538a-4f98-8d60-250803a80e2a" target="_blank">http://www.microsoft.com/downloads/de...=e1d3a4c3-538a-4f98-8d60-250803a80e2a</a> Microsoft Works 8.5: According to the vendor, patches are still in development and will be released at a later stage. Microsoft Works 9.0: According to the vendor, patches are still in development and will be released at a later stage.<br><b>Provided and/or discovered by</b>:<br>1) Carsten Eiram, Secunia Research. 2) The vendor credits an anonymous person via VeriSign iDefense Labs. 3) The vendor credits Sean Larsson, VeriSign iDefense Labs. 4) The vendor credits Sean Larsson, VeriSign iDefense Labs. 5) The vendor credits Ling and Wushi, team509 via ZDI and Sean Larsson, VeriSign iDefense Labs. 6) The vendor credits: * Marsu Pilami, VeriSign iDefense Labs. * Nicolas Joly, Vupen. * An anonymous person via VeriSign iDefense Labs.<br><b>Original Advisory</b>:<br>MS09-017 (KB957781, KB957784, KB957789, KB957790, KB967340, KB969615, KB969618, KB970059): <a href="http://www.microsoft.com/technet/security/Bulletin/MS09-017.mspx" target="_blank">http://www.microsoft.com/technet/security/Bulletin/MS09-017.mspx</a> id SSV:11282 last seen 2017-11-19 modified 2009-05-13 published 2009-05-13 reporter Root title Microsoft PowerPoint多个安全漏洞 bulletinFamily exploit description BUGTRAQ ID: 34879 CVE(CAN) ID: CVE-2009-0224 Microsoft PowerPoint是微软Office套件中的文档演示工具。 PowerPoint在解析BuildList记录时存在内存破坏漏洞。BuildList记录是用于描述PowerPoint文件中表格和图标的其他记录的容器。如果所注入的多个BuildList记录中包含有ChartBuild容器的话，在解析ChartBuild容器的内容时就会触发内存破坏，允许攻击者控制对象指针并引用受控的函数。 Microsoft Office 2008 for Mac Microsoft Office 2004 for Mac Microsoft PowerPoint Viewer 2007 SP2 Microsoft PowerPoint Viewer 2007 SP1 Microsoft PowerPoint Viewer 2003 Microsoft PowerPoint 2007 SP2 Microsoft PowerPoint 2007 SP1 Microsoft PowerPoint 2003 SP3 Microsoft PowerPoint 2002 SP3 Microsoft PowerPoint 2000 SP3 Microsoft Works 9.0 Microsoft Works 8.5 临时解决方法： * 在打开未知或不可信任来源的文件时，使用Microsoft Office隔离转换环境（MOICE）。 * 使用Microsoft Office文件阻断策略以防止打开未知或不可信任来源的Office2003及更早版本的文档。可使用以下注册表脚本为Office 2003设置文件阻断策略： Office 2003 Windows Registry Editor Version 5.00 [HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Excel\Security\FileOpenBlock] "BinaryFiles"=dword:00000001 * 不要打开或保存从不受信任来源或从受信任来源意外收到的Microsoft Office文件。 厂商补丁： Microsoft --------- Microsoft已经为此发布了一个安全公告（MS09-017）以及相应补丁: MS09-017：Vulnerabilities in Microsoft Office PowerPoint Could Allow Remote Code Execution (967340) 链接：<a href="http://www.microsoft.com/technet/security/bulletin/ms09-017.mspx?pf=true" target="_blank" rel=external nofollow>http://www.microsoft.com/technet/security/bulletin/ms09-017.mspx?pf=true</a> id SSV:11305 last seen 2017-11-19 modified 2009-05-15 published 2009-05-15 reporter Root title Microsoft PowerPoint BuildList记录内存破坏漏洞（MS09-017）
References
- http://www.us-cert.gov/cas/techalerts/TA09-132A.html
- http://www.securitytracker.com/id?1022205
- http://www.vupen.com/english/advisories/2009/1290
- http://www.securityfocus.com/bid/34879
- http://secunia.com/advisories/32428
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=793
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6023
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017