CVE-2009-1534
Microsoft OWC Spreadsheet - HTMLURL Buffer Overflow (MS09-043)
Severity Score
9.3
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2000 Web Components SP3, Office XP Web Components SP3, BizTalk Server 2002, and Visual Studio .NET 2003 SP1 allows remote attackers to execute arbitrary code via crafted property values, aka "Office Web Components Buffer Overflow Vulnerability."
Desbordamiento de búfer en Office Web Components ActiveX Control en Microsoft Office XP SP3, Office 2000 Web Components SP3, Office XP Web Components SP3, BizTalk Server 2002, y Visual Studio .NET 2003 SP1 permite a atacantes remotos ejecutar código de su elección mediante valores modificados en la propiedad, también conocido como "Vulnerabilidad de desbordamiento de búfer en Office Web Components".
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2009-05-05 CVE Reserved
- 2009-08-12 CVE Published
- 2010-04-30 First Exploit
- 2024-08-07 CVE Updated
- 2024-11-05 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| http://osvdb.org/56916 | Vdb Entry | |
| http://www.securitytracker.com/id?1022708 | Vdb Entry | |
| http://www.us-cert.gov/cas/techalerts/TA09-223A.html | Third Party Advisory | |
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6326 | Signature |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/16542 | 2010-04-30 |
| URL | Date | SRC |
|---|---|---|
| http://www.securityfocus.com/bid/35992 | 2018-10-12 |
| URL | Date | SRC |
|---|---|---|
| https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-043 | 2018-10-12 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Microsoft Search vendor "Microsoft" | Biztalk Server Search vendor "Microsoft" for product "Biztalk Server" | 2002 Search vendor "Microsoft" for product "Biztalk Server" and version "2002" | - |
Safe
| ||||||
| Microsoft Search vendor "Microsoft" | Isa Server Search vendor "Microsoft" for product "Isa Server" | 2004 Search vendor "Microsoft" for product "Isa Server" and version "2004" | sp3, enterprise |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Isa Server Search vendor "Microsoft" for product "Isa Server" | 2004 Search vendor "Microsoft" for product "Isa Server" and version "2004" | sp3, standard |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Isa Server Search vendor "Microsoft" for product "Isa Server" | 2006 Search vendor "Microsoft" for product "Isa Server" and version "2006" | sp1, enterprise |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Isa Server Search vendor "Microsoft" for product "Isa Server" | 2006 Search vendor "Microsoft" for product "Isa Server" and version "2006" | sp1, standard |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Office Search vendor "Microsoft" for product "Office" | - | small_business_accounting_2006 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Office Search vendor "Microsoft" for product "Office" | 2003 Search vendor "Microsoft" for product "Office" and version "2003" | sp3 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Office Search vendor "Microsoft" for product "Office" | xp Search vendor "Microsoft" for product "Office" and version "xp" | sp3 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Office Web Components Search vendor "Microsoft" for product "Office Web Components" | 2000 Search vendor "Microsoft" for product "Office Web Components" and version "2000" | sp3 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Office Web Components Search vendor "Microsoft" for product "Office Web Components" | 2003 Search vendor "Microsoft" for product "Office Web Components" and version "2003" | sp1, 2007_microsoft_office |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Office Web Components Search vendor "Microsoft" for product "Office Web Components" | 2003 Search vendor "Microsoft" for product "Office Web Components" and version "2003" | sp3 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Office Web Components Search vendor "Microsoft" for product "Office Web Components" | xp Search vendor "Microsoft" for product "Office Web Components" and version "xp" | sp3 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Visual Studio .net Search vendor "Microsoft" for product "Visual Studio .net" | 2003 Search vendor "Microsoft" for product "Visual Studio .net" and version "2003" | sp1 |
Safe
| ||||||