Vulnerabilities > CVE-2009-0556 - Code Injection vulnerability in Microsoft Office Powerpoint and Powerpoint

047910
CVSS 9.3 - CRITICAL
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
microsoft
CWE-94
critical
nessus
NVD
Published: 2009-04-03
Updated: 2018-10-12

Summary

Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an an invalid index value that triggers memory corruption, as exploited in the wild in April 2009 by Exploit:Win32/Apptom.gen, aka "Memory Corruption Vulnerability."

Vulnerable Configurations

Part Description Count
Application
Microsoft
4

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Leverage Executable Code in Non-Executable Files
    An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
  • Manipulating User-Controlled Variables
    This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An attacker can override environment variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the attacker can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.

Msbulletin

bulletin_idMS09-017
bulletin_url
date2009-05-12T00:00:00
impactRemote Code Execution
knowledgebase_id967340
knowledgebase_url
severityCritical
titleVulnerabilities in Microsoft Office PowerPoint Could Allow Remote Code Execution

Nessus

NASL familyWindows : Microsoft Bulletins
NASL idSMB_NT_MS09-017.NASL
descriptionThe remote Windows host is running a version of Microsoft PowerPoint, PowerPoint Viewer, or PowerPoint Converter that is affected by multiple vulnerabilities. If an attacker can trick a user on the affected host into opening a specially crafted PowerPoint file, he could leverage these issues to execute arbitrary code subject to the user
last seen2020-06-01
modified2020-06-02
plugin id38742
published2009-05-13
reporterThis script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/38742
titleMS09-017: Vulnerabilities in Microsoft Office PowerPoint Could Allow Remote Code Execution (967340)
code
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(38742);
  script_version("1.40");
  script_cvs_date("Date: 2019/12/13");

  script_cve_id(
    "CVE-2009-0220",
    "CVE-2009-0221",
    "CVE-2009-0222",
    "CVE-2009-0223",
    "CVE-2009-0224",
    "CVE-2009-0225",
    "CVE-2009-0226",
    "CVE-2009-0227",
    "CVE-2009-0556",
    "CVE-2009-1128",
    "CVE-2009-1129",
    "CVE-2009-1130",
    "CVE-2009-1131",
    "CVE-2009-1137"
  );
  script_bugtraq_id(
    34351,
    34831,
    34833,
    34834,
    34835,
    34837,
    34839,
    34840,
    34841,
    34876,
    34879,
    34880,
    34881,
    34882
  );
  script_xref(name:"CERT", value:"627331");
  script_xref(name:"MSFT", value:"MS09-017");
  script_xref(name:"MSKB", value:"957781");
  script_xref(name:"MSKB", value:"957784");
  script_xref(name:"MSKB", value:"957789");
  script_xref(name:"MSKB", value:"957790");
  script_xref(name:"MSKB", value:"969615");
  script_xref(name:"MSKB", value:"969618");
  script_xref(name:"MSKB", value:"970059");

  script_name(english:"MS09-017: Vulnerabilities in Microsoft Office PowerPoint Could Allow Remote Code Execution (967340)");
  script_summary(english:"Checks version of PowerPoint");

  script_set_attribute(
    attribute:"synopsis",
    value:
"Arbitrary code can be executed on the remote host through Microsoft
PowerPoint."
  );
  script_set_attribute(
    attribute:"description",
    value:
"The remote Windows host is running a version of Microsoft PowerPoint,
PowerPoint Viewer, or PowerPoint Converter that is affected by
multiple vulnerabilities.  If an attacker can trick a user on the
affected host into opening a specially crafted PowerPoint file, he
could leverage these issues to execute arbitrary code subject to the
user's privileges."
  );
  # https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2009/ms09-017
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?514f3bd5");
  script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-09-019/");
  script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-09-020/");
  script_set_attribute(
    attribute:"solution",
    value:
"Microsoft has released a set of patches for PowerPoint 2000, 2002,
2003, and 2007, PowerPoint Viewer 2003 and 2007, as well as the
Microsoft Office Compatibility Pack."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");
  script_cwe_id(94, 119, 189);

  script_set_attribute(attribute:"vuln_publication_date", value:"2009/04/02");
  script_set_attribute(attribute:"patch_publication_date", value:"2009/05/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2009/05/13");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows : Microsoft Bulletins");

  script_copyright(english:"This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("smb_nt_ms02-031.nasl", "office_installed.nasl", "ms_bulletin_checks_possible.nasl");
  script_require_keys("SMB/MS_Bulletin_Checks/Possible");
  script_require_ports(139, 445, 'Host/patch_management_checks');

  exit(0);
}


include("smb_hotfixes_fcheck.inc");
include("smb_hotfixes.inc");
include("misc_func.inc");
include("audit.inc");

get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");

bulletin = 'MS09-017';
kbs = make_list("957781", "957784", "957789", "957790", "969615", "969618", "970059");
if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);


# PowerPoint.
info = "";
pp_patched = FALSE;
vuln = 0;
kb = "";
installs = get_kb_list("SMB/Office/PowerPoint/*/ProductPath");
if (!isnull(installs))
{
  foreach install (keys(installs))
  {
    version = install - 'SMB/Office/PowerPoint/' - '/ProductPath';
    path = installs[install];
    if (isnull(path)) path = "n/a";

    ver = split(version, sep:'.', keep:FALSE);
    for (i=0; i<max_index(ver); i++)
      ver[i] = int(ver[i]);

    # PowerPoint 2007.
    if (
      ver[0] == 12 && ver[1] == 0 &&
      (
        ver[2] < 6500 ||
        (ver[2] == 6500 && ver[3] < 5000)
      )
    )
    {
      office_sp = get_kb_item("SMB/Office/2007/SP");
      if (!isnull(office_sp) && (office_sp == 1 || office_sp == 2))
      {
        vuln++;
        kb = "957789";
        info =
          '\n  Product           : PowerPoint 2007' +
          '\n  File              : ' + path +
          '\n  Installed version : ' + version +
          '\n  Fixed version     : 12.0.6500.5000\n';
        hotfix_add_report(info, bulletin:bulletin, kb:kb);
      }
    }
    # PowerPoint 2003.
    else if (ver[0] == 11 && ver[1] == 0 && ver[2] < 8307)
    {
      office_sp = get_kb_item("SMB/Office/2003/SP");
      if (!isnull(office_sp) && office_sp == 3)
      {
        vuln++;
        kb = "957784";
        info =
          '\n  Product           : PowerPoint 2003' +
          '\n  File              : ' + path +
          '\n  Installed version : ' + version +
          '\n  Fixed version     : 11.0.8307.0\n';
        hotfix_add_report(info, bulletin:bulletin, kb:kb);
      }
    }
    # PowerPoint 2002.
    else if (ver[0] == 10 && ver[1] == 0 && ver[2] < 6853)
    {
      office_sp = get_kb_item("SMB/Office/XP/SP");
      if (!isnull(office_sp) && office_sp == 3)
      {
        vuln++;
        kb = "957781";
        info =
          '\n  Product           : PowerPoint 2002' +
          '\n  File              : ' + path +
          '\n  Installed version : ' + version +
          '\n  Fixed version     : 10.0.6853.0\n';
        hotfix_add_report(info, bulletin:bulletin, kb:kb);
      }
    }
    # PowerPoint 2000 - fixed in 9.0.0.8978
    else if (ver[0] == 9 && ver[1] == 0 && ver[2] == 0 && ver[3] < 8978)
    {
      office_sp = get_kb_item("SMB/Office/2000/SP");
      if (!isnull(office_sp) && office_sp == 3)
      {
        vuln++;
        kb = "957790";
        info =
          '\n  Product           : PowerPoint 2000' +
          '\n  File              : ' + path +
          '\n  Installed version : ' + version +
          '\n  Fixed version     : 9.0.0.8978\n';
        hotfix_add_report(info, bulletin:bulletin, kb:kb);
      }
    }
  }
}
if (!vuln) pp_patched = TRUE;

# PowerPoint Viewer.
installs = get_kb_list("SMB/Office/PowerPointViewer/*/ProductPath");
if (!isnull(installs) && !pp_patched)
{
  version = install - 'SMB/Office/PowerPointViewer/' - '/ProductPath';
  path = installs[install];
  if (isnull(path)) path = 'n/a';

  ver = split(version, sep:'.', keep:FALSE);
  for (i=0; i<max_index(ver); i++)
    ver[i] = int(ver[i]);

  # PowerPoint Viewer 2007.
  if (
    ver[0] == 12 && ver[1] == 0 &&
    (
      ver[2] < 6502 ||
      (ver[2] == 6502 && ver[3] < 5000)
    )
  )
  {
    vuln++;
    kb = "970059";
    info =
      '\n  Product           : PowerPoint Viewer 2007' +
      '\n  File              : ' + path +
      '\n  Installed version : ' + version +
      '\n  Fixed version     : 12.0.6502.5000\n';
    hotfix_add_report(info, bulletin:bulletin, kb:kb);
  }
  # Office PowerPoint Viewer 2003.
  else if (ver[0] == 11 && ver[1] == 0 && ver[2] < 8305)
  {
    kb = "969615";
    info =
      '\n  Product           : Office PowerPoint Viewer 2003' +
      '\n  File              : ' + path +
      '\n  Installed version : ' + version +
      '\n  Fixed version     : 11.0.8305.0\n';
    hotfix_add_report(info, bulletin:bulletin, kb:kb);
  }
}

# PowerPoint Converter.
installs = get_kb_list("SMB/Office/PowerPointCnv/*/ProductPath");
if (!isnull(installs))
{
  foreach install (keys(installs))
  {
    version = install - 'SMB/Office/PowerPointCnv/' - '/ProductPath';
    path = installs[install];
    if (isnull(path)) path = 'n/a';

    ver = split(version, sep:'.', keep:FALSE);
    for (i=0; i<max_index(ver); i++)
      ver[i] = int(ver[i]);

    #  PowerPoint 2007 converter.
    if (
      ver[0] == 12 && ver[1] == 0 &&
      (
        ver[2] < 6500 ||
        (ver[2] == 6500 && ver[3] < 5000)
      )
    )
    {
      vuln++;
      kb = "969618";
      info =
        '\n  Product           : PowerPoint 2007 Converter' +
        '\n  File              : ' + path +
        '\n  Installed version : ' + version +
        '\n  Fixed version     : 12.0.6500.5000\n';
      hotfix_add_report(info, kb:kb, bulletin:bulletin);
    }
  }
}
if (vuln)
{
  set_kb_item(name:"SMB/Missing/"+bulletin, value:TRUE);
  hotfix_security_hole();
  exit(0);
}
else audit(AUDIT_HOST_NOT, 'affected');

Oval

  • accepted2009-05-18T04:00:27.768-04:00
    classvulnerability
    contributors
    • nameChandan S
      organizationSecPod Technologies
    • nameJ. Daniel Brown
      organizationDTCC
    • nameShane Shaffer
      organizationG2, Inc.
    definition_extensions
    • commentMicrosoft PowerPoint 2000 is installed
      ovaloval:org.mitre.oval:def:696
    • commentMicrosoft PowerPoint 2002 is installed
      ovaloval:org.mitre.oval:def:305
    • commentMicrosoft PowerPoint 2003 is installed
      ovaloval:org.mitre.oval:def:666
    descriptionMicrosoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an an invalid index value that triggers memory corruption, as exploited in the wild in April 2009 by Exploit:Win32/Apptom.gen, aka "Memory Corruption Vulnerability."
    familywindows
    idoval:org.mitre.oval:def:6204
    statusdeprecated
    submitted2009-04-08T11:21:42
    titleMS PowerPoint File Parsing Remote Code Execution Vulnerability
    version3
  • accepted2012-05-28T04:02:04.935-04:00
    classvulnerability
    contributors
    • nameT.J. Butler
      organizationGideon Technologies, Inc.
    • nameBrendan Miles
      organizationThe MITRE Corporation
    • nameShane Shaffer
      organizationG2, Inc.
    definition_extensions
    • commentMicrosoft PowerPoint 2000 is installed
      ovaloval:org.mitre.oval:def:696
    • commentMicrosoft PowerPoint 2002 is installed
      ovaloval:org.mitre.oval:def:305
    • commentMicrosoft PowerPoint 2003 is installed
      ovaloval:org.mitre.oval:def:666
    descriptionMicrosoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an an invalid index value that triggers memory corruption, as exploited in the wild in April 2009 by Exploit:Win32/Apptom.gen, aka "Memory Corruption Vulnerability."
    familywindows
    idoval:org.mitre.oval:def:6279
    statusaccepted
    submitted2009-05-12T09:28:00
    titleMemory Corruption Vulnerability
    version4

Saint

bid34351
descriptionMicrosoft PowerPoint invalid object reference vulnerability
osvdb53182
titlepowerpoint_invalid_object
typeclient

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 34351 CVE(CAN) ID: CVE-2009-0556 Microsoft PowerPoint是微软Office套件中的文档演示工具。 PowerPoint在解析特制的PPT文件时可能会导致访问内存中的无效对象，这可能允许攻击者执行任意代码。目前这个漏洞正在被名为Exploit:Win32/Apptom.gen的病毒积极的理由。 Microsoft PowerPoint 2004 for Mac Microsoft PowerPoint 2003 SP3 Microsoft PowerPoint 2002 SP3 Microsoft PowerPoint 2000 SP3 临时解决方法： * 在打开未知或不可信任来源的文件时，使用Microsoft Office隔离转换环境（MOICE）。 * 使用Microsoft Office文件阻断策略以防止打开未知或不可信任来源的Office 2003及更早版本的文档。可使用以下注册表脚本为Office 2003设置文件阻断策略： Office 2003 Windows Registry Editor Version 5.00 [HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Excel\Security\FileOpenBlock] &quot;BinaryFiles&quot;=dword:00000001 2007 Office system Windows Registry Editor Version 5.00 [HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Excel\Security\FileOpenBlock] &quot;BinaryFiles&quot;=dword:00000001 * 不要打开或保存从不受信任来源或从受信任来源意外收到的Microsoft Office文件。 厂商补丁： Microsoft --------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： <a href=http://www.microsoft.com/technet/security/ target=_blank rel=external nofollow>http://www.microsoft.com/technet/security/</a>
idSSV:5018
last seen2017-11-19
modified2009-04-08
published2009-04-08
reporterRoot
titlePowerPoint畸形文件解析代码执行漏洞

References