| Secunia ID |
SA33954
|
| CVE-ID |
CVE-2009-0100, CVE-2009-0238
|
| Release Date |
24 Feb 2009
|
| Last Change |
15 Apr 2009
|
| Criticality |
Extremely Critical
Typically used for remotely exploitable vulnerabilities that can lead to system compromise. Successful exploitation does not normally require any interaction and exploits are in the wild.
These vulnerabilities can exist in services like FTP, HTTP, and SMTP or in certain client systems like email programs or browsers.
|
| Solution Status |
Vendor Patch
|
| Software |
Microsoft Excel 2000
Microsoft Excel 2002
Microsoft Excel 2003
Microsoft Office 2000
Microsoft Office 2003 Professional Edition
Microsoft Office 2003 Small Business Edition
Microsoft Office 2003 Standard Edition
Microsoft Office 2003 Student and Teacher Edition
Microsoft Office 2004 for Mac
Microsoft Office 2007
Microsoft Office 2008 for Mac
Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats
Microsoft Office Excel 2007
Microsoft Office Excel Viewer 2003
Microsoft Office Excel Viewer 2007
Microsoft Office XP
|
| Where |
From remote
"From remote" describes other vulnerabilities where the attack vector doesn't require access to the system or a local network.
This category covers services that are acceptable to expose to the Internet (e.g. HTTP, HTTPS, SMTP). It also covers client applications used on the Internet and certain vulnerabilities where it is reasonable to assume that a security conscious user can be tricked into performing certain actions.
|
| Impact |
System access
This covers vulnerabilities where malicious people are able to gain system access and execute arbitrary code with the privileges of a local user.
|
| Description |
Two vulnerabilities have been reported in Microsoft Excel, which can be exploited by malicious people to compromise a user's system. 1) An error may cause an invalid object to be referenced when opening an Excel document and can be exploited via a specially crafted Excel spreadsheet file. NOTE: According to Microsoft, the vulnerability is currently being actively exploited. 2) An error when processing an unspecified 16-bit value extracted from an Excel document can be exploited to corrupt memory. Successful exploitation may allow execution of arbitrary code.
|
| Solution |
Apply patches. Microsoft Office Excel 2000 SP3:
http://www.microsoft.com/downloads/details.aspx?familyid=3dc8b670-25a5-4f46-b7de-12bc693b628a Microsoft Office Excel 2002 SP3:
http://www.microsoft.com/downloads/details.aspx?familyid=9a52bf4b-05f6-4b73-94b9-28ed7e20f86c Microsoft Office Excel 2003 SP3:
http://www.microsoft.com/downloads/details.aspx?familyid=d9dbfa63-c0cb-4c84-9b8a-6e52568045b0 Microsoft Office Excel 2007 SP1:
http://www.microsoft.com/downloads/details.aspx?familyid=50d8630b-1365-4007-81a0-18c0d6d4b86e Microsoft Office 2004 for Mac:
http://www.microsoft.com/downloads/details.aspx?familyid=52271140-89be-4b9c-baa2-cea09097d703 Microsoft Office 2008 for Mac:
http://www.microsoft.com/downloads/details.aspx?familyid=f6e407eb-11a5-433f-8006-4b822953ca98 Microsoft Office Excel Viewer 2003 SP3:
http://www.microsoft.com/downloads/details.aspx?familyid=c72e6087-b48f-4d2d-8366-01d9f5ff6b6c Microsoft Office Excel Viewer 2007:
http://www.microsoft.com/downloads/details.aspx?familyid=58b3929c-5373-47a4-aa97-66d179758792 Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1:
http://www.microsoft.com/downloads/details.aspx?familyid=05f7c517-e551-4dcd-b24a-5d548f2d09cf
|
| Reported by |
1) Reported as a 0-day.
2) Haifei Li, Fortinet FortiGuard Global Security Research Team
|
| Original Advisory |
MS09-009 (KB968557, KB959964, KB959988, KB959995, KB959997, KB959993, KB960000, KB960003):
http://www.microsoft.com/technet/security/Bulletin/MS09-009.mspx Microsoft:
http://www.microsoft.com/technet/security/advisory/968272.mspx FortiGuard:
http://www.fortiguardcenter.com/advisory/FGA-2009-16.html
|
Internet threat level: 1
