CVE-2009-0562
Microsoft Office OWC10 ActiveX Control Loading and Unloading Heap Corruption Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, Office 2003 Web Components SP1 for the 2007 Microsoft Office System, Internet Security and Acceleration (ISA) Server 2004 SP3 and 2006 SP1, and Office Small Business Accounting 2006 does not properly allocate memory, which allows remote attackers to execute arbitrary code via unspecified vectors that trigger "system state" corruption, aka "Office Web Components Memory Allocation Vulnerability."
El control Office Web Components ActiveX en Microsoft Office XP SP3, Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, Office 2003 Web Components SP1 para el 2007 Microsoft Office System, Internet Security and Acceleration (ISA) Server 2004 SP3 y 2006 SP1, y Office Small Business Accounting 2006, no asignan memoria adecuadamente, lo que permite a atacantes remotos la ejecución de código de su elección a través de vectores no especificados que lanzan una corrupción en el estado del sistema (System state), también conocida como "Vulnerabilidad de asignación de memoria en Office Web Components".
This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Microsoft Office. User interaction is required to exploit this vulnerability in that the target must visit a malicious page.
The specific flaw exists when loading and unloading the vulnerable control (0002E543-0000-0000-C000-000000000046) and results in transfer of control to unallocated memory. This issue can be exploited to execute arbitrary code under the context of the currently logged in user user.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2009-02-12 CVE Reserved
- 2009-08-11 CVE Published
- 2024-08-07 CVE Updated
- 2024-11-05 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-399: Resource Management Errors
CAPEC
References (4)
| URL | Tag | Source |
|---|---|---|
| http://www.securitytracker.com/id?1022708 | Vdb Entry | |
| http://www.us-cert.gov/cas/techalerts/TA09-223A.html | Third Party Advisory | |
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6337 | Signature |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-043 | 2018-10-12 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Microsoft Search vendor "Microsoft" | Isa Server Search vendor "Microsoft" for product "Isa Server" | 2004 Search vendor "Microsoft" for product "Isa Server" and version "2004" | sp3, enterprise |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Isa Server Search vendor "Microsoft" for product "Isa Server" | 2004 Search vendor "Microsoft" for product "Isa Server" and version "2004" | sp3, standard |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Isa Server Search vendor "Microsoft" for product "Isa Server" | 2006 Search vendor "Microsoft" for product "Isa Server" and version "2006" | sp1, enterprise |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Isa Server Search vendor "Microsoft" for product "Isa Server" | 2006 Search vendor "Microsoft" for product "Isa Server" and version "2006" | sp1, standard |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Office Search vendor "Microsoft" for product "Office" | - | small_business_accounting_2006 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Office Search vendor "Microsoft" for product "Office" | 2003 Search vendor "Microsoft" for product "Office" and version "2003" | sp3 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Office Search vendor "Microsoft" for product "Office" | xp Search vendor "Microsoft" for product "Office" and version "xp" | sp3 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Office Web Components Search vendor "Microsoft" for product "Office Web Components" | 2000 Search vendor "Microsoft" for product "Office Web Components" and version "2000" | sp3 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Office Web Components Search vendor "Microsoft" for product "Office Web Components" | 2003 Search vendor "Microsoft" for product "Office Web Components" and version "2003" | sp1, 2007_microsoft_office |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Office Web Components Search vendor "Microsoft" for product "Office Web Components" | 2003 Search vendor "Microsoft" for product "Office Web Components" and version "2003" | sp3 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Office Web Components Search vendor "Microsoft" for product "Office Web Components" | xp Search vendor "Microsoft" for product "Office Web Components" and version "xp" | sp3 |
Affected
| ||||||