CVE-2009-3134

Severity Score

9.3

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 do not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a spreadsheet with a malformed record object, aka "Excel Field Sanitization Vulnerability."

Microsoft Office Excel 2002 SP3, v2003 SP3, y v2007 SP1 y SP2; Office v2004 y v2008 para Mac; Open XML File Format Converter para Mac; Office Excel Viewer v2003 SP3; Office Excel Viewer SP1 y SP2; y Office Compatibility Pack para Word, Excel, y PowerPoint v2007 File Formats SP1 y SP2 no analiza adecuadamente el formato de archivo Excel, permitiendo a atacantes remotos ejecutar código de su elección a través de una hoja de cálculo con un objeto manipulada como "Vulnerabilidad en la limpieza de campo Excel".

*Credits: N/A

CVSS Scores

NISTv2 9.3

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2009-09-10 CVE Reserved
2009-11-11 CVE Published
2024-08-07 CVE Updated
2024-10-18 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-94: Improper Control of Generation of Code ('Code Injection')

CAPEC

References (4)

URL	Tag	Source
http://www.securitytracker.com/id?1023157	Vdb Entry
http://www.us-cert.gov/cas/techalerts/TA09-314A.html	Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5878	Signature

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-067	2018-10-12

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Microsoft Search vendor "Microsoft"		Compatibility Pack Word Excel Powerpoint Search vendor "Microsoft" for product "Compatibility Pack Word Excel Powerpoint"				2007 Search vendor "Microsoft" for product "Compatibility Pack Word Excel Powerpoint" and version "2007"		sp1		Affected
Microsoft Search vendor "Microsoft"		Compatibility Pack Word Excel Powerpoint Search vendor "Microsoft" for product "Compatibility Pack Word Excel Powerpoint"				2007 Search vendor "Microsoft" for product "Compatibility Pack Word Excel Powerpoint" and version "2007"		sp2		Affected
Microsoft Search vendor "Microsoft"		Excel Search vendor "Microsoft" for product "Excel"				2002 Search vendor "Microsoft" for product "Excel" and version "2002"		sp3		Affected
Microsoft Search vendor "Microsoft"		Excel Search vendor "Microsoft" for product "Excel"				2003 Search vendor "Microsoft" for product "Excel" and version "2003"		sp3		Affected
Microsoft Search vendor "Microsoft"		Excel Search vendor "Microsoft" for product "Excel"				2007 Search vendor "Microsoft" for product "Excel" and version "2007"		sp1		Affected
Microsoft Search vendor "Microsoft"		Excel Search vendor "Microsoft" for product "Excel"				2007 Search vendor "Microsoft" for product "Excel" and version "2007"		sp2		Affected
Microsoft Search vendor "Microsoft"		Excel Viewer Search vendor "Microsoft" for product "Excel Viewer"				*		sp1		Affected
Microsoft Search vendor "Microsoft"		Excel Viewer Search vendor "Microsoft" for product "Excel Viewer"				*		sp2		Affected
Microsoft Search vendor "Microsoft"		Excel Viewer Search vendor "Microsoft" for product "Excel Viewer"				2003 Search vendor "Microsoft" for product "Excel Viewer" and version "2003"		sp3		Affected
Microsoft Search vendor "Microsoft"		Office Search vendor "Microsoft" for product "Office"				2004 Search vendor "Microsoft" for product "Office" and version "2004"		mac		Affected
Microsoft Search vendor "Microsoft"		Office Search vendor "Microsoft" for product "Office"				2008 Search vendor "Microsoft" for product "Office" and version "2008"		mac		Affected
Microsoft Search vendor "Microsoft"		Open Xml File Format Converter Search vendor "Microsoft" for product "Open Xml File Format Converter"				*		mac		Affected