Microsoft Word Bulleted List Handling Remote Memory Corruption Vulnerability

Bugtraq ID:	29769
Class:	Boundary Condition Error
CVE:	CVE-2008-2752 CVE-2009-0087
Remote:	Yes
Local:	No
Published:	Jun 17 2008 12:00AM
Updated:	Jul 05 2016 10:01PM
Credit:	Ivan Sanchez
Vulnerable:	Microsoft Word 2002 SP3 Microsoft Word 2002 SP2 + Microsoft Office XP SP2 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Microsoft Word 2002 SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 alpha - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Microsoft Word 2002 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 alpha - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Microsoft Word 2000 SR1a + Microsoft Office 2000 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Microsoft Word 2000 SR1 + Microsoft Office 2000 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Microsoft Word 2000 SP3 + Microsoft Office 2000 SP3 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Microsoft Word 2000 SP2 + Microsoft Office 2000 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Microsoft Word 2000 + Microsoft Office 2000 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Microsoft Windows XP Tablet PC Edition SP3 Microsoft Windows XP Tablet PC Edition SP2 Microsoft Windows XP Tablet PC Edition SP1 Microsoft Windows XP Tablet PC Edition Microsoft Windows XP Professional x64 Edition SP2 Microsoft Windows XP Professional x64 Edition Microsoft Windows XP Professional SP3 Microsoft Windows XP Professional SP2 Microsoft Windows XP Professional SP1 Microsoft Windows XP Professional Microsoft Windows XP Media Center Edition SP3 Microsoft Windows XP Media Center Edition SP2 Microsoft Windows XP Media Center Edition SP1 Microsoft Windows XP Media Center Edition Microsoft Windows XP Home SP3 Microsoft Windows XP Home SP2 Microsoft Windows XP Home SP1 Microsoft Windows XP Home Microsoft Windows XP Gold 0 Microsoft Windows XP Embedded SP3 Microsoft Windows XP Embedded SP2 Microsoft Windows XP Embedded SP1 Microsoft Windows XP Embedded Microsoft Windows XP 64-bit Edition SP1 Microsoft Windows XP 64-bit Edition Microsoft Windows XP 0 Microsoft Windows Server 2003 x64 SP2 Microsoft Windows Server 2003 x64 SP1 Microsoft Windows Server 2003 Web Edition SP2 Microsoft Windows Server 2003 Web Edition SP1 Beta 1 Microsoft Windows Server 2003 Web Edition SP1 Microsoft Windows Server 2003 Web Edition Microsoft Windows Server 2003 Standard x64 Edition Microsoft Windows Server 2003 Standard Edition SP2 Microsoft Windows Server 2003 Standard Edition SP1 Beta 1 Microsoft Windows Server 2003 Standard Edition SP1 Microsoft Windows Server 2003 Standard Edition Microsoft Windows Server 2003 Itanium SP2 Microsoft Windows Server 2003 Itanium SP1 Microsoft Windows Server 2003 Itanium 0 Microsoft Windows Server 2003 Enterprise x64 Edition SP2 Microsoft Windows Server 2003 Enterprise x64 Edition Microsoft Windows Server 2003 Enterprise Edition Itanium SP1 Beta 1 Microsoft Windows Server 2003 Enterprise Edition Itanium SP1 Microsoft Windows Server 2003 Enterprise Edition Itanium 0 Microsoft Windows Server 2003 Enterprise Edition SP1 Beta 1 Microsoft Windows Server 2003 Enterprise Edition SP1 Microsoft Windows Server 2003 Enterprise Edition Microsoft Windows Server 2003 Datacenter x64 Edition SP2 Microsoft Windows Server 2003 Datacenter x64 Edition Microsoft Windows Server 2003 Datacenter Edition Itanium SP1 Beta 1 Microsoft Windows Server 2003 Datacenter Edition Itanium SP1 Microsoft Windows Server 2003 Datacenter Edition Itanium 0 Microsoft Windows Server 2003 Datacenter Edition SP1 Beta 1 Microsoft Windows Server 2003 Datacenter Edition SP1 Microsoft Windows Server 2003 Datacenter Edition Microsoft Windows Server 2003 SP2 Microsoft Windows Server 2003 SP1 Platform SDK Microsoft Windows Server 2003 SP1 Microsoft Windows Server 2003 R2 Platfom SDK Microsoft Windows 2000 Professional SP4 Microsoft Windows 2000 Professional SP3 Microsoft Windows 2000 Professional SP2 Microsoft Windows 2000 Professional SP1 Microsoft Windows 2000 Professional Avaya Messaging Application Server MM 3.1 Avaya Messaging Application Server MM 3.0 Avaya Messaging Application Server MM 2.0 Avaya Messaging Application Server MM 1.1 Avaya Messaging Application Server 0
Not Vulnerable:

Microsoft Word Bulleted List Handling Remote Memory Corruption Vulnerability

Microsoft Word is prone to a remote memory-corruption vulnerability.

An attacker could exploit this issue by enticing a victim to open and interact with malicious Word files.

Successfully exploiting this issue will corrupt memory and crash the application. Given the nature of this issue, attackers may also be able to execute arbitrary code in the context of the currently logged-in user.

Microsoft Word Bulleted List Handling Remote Memory Corruption Vulnerability

The following proof-of-concept exploits are available:

• /data/vulnerabilities/exploits/crash-word-4.doc
• /data/vulnerabilities/exploits/crash-word-2.doc
• /data/vulnerabilities/exploits/crash-word-3.doc
• /data/vulnerabilities/exploits/crash-word-1.doc

Microsoft Word Bulleted List Handling Remote Memory Corruption Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for more information.


Microsoft Windows Server 2003 Datacenter Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB923561)
  http://www.microsoft.com/downloads/details.aspx?familyid=2233a4d2-7c8a -4c89-b020-100d9afb43c8

Microsoft Windows XP Media Center Edition SP2

• Microsoft Security Update for Windows XP (KB923561)
  http://www.microsoft.com/downloads/details.aspx?familyid=50a8519a-503e -43dd-a78a-c1bc764fd213

Microsoft Word 2000

• Microsoft Security Update for Office 2000 (KB921606)
  http://www.microsoft.com/downloads/details.aspx?familyid=95876927-e612 -414c-bdec-3632a3100415&displaylang=en

Microsoft Windows Server 2003 Itanium SP1

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB923561)
  http://www.microsoft.com/downloads/details.aspx?familyid=e840b9cb-f1f4 -482a-aa07-eb6b42b477c4

Microsoft Windows Server 2003 Enterprise Edition Itanium SP1

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB923561)
  http://www.microsoft.com/downloads/details.aspx?familyid=e840b9cb-f1f4 -482a-aa07-eb6b42b477c4

Microsoft Word 2002 SP2

• Microsoft Security Update for Office XP (KB933399)
  http://www.microsoft.com/downloads/details.aspx?familyid=e1db55c6-78fb -498d-89a5-9ad54d971546&displaylang=en

Microsoft Windows Server 2003 Datacenter x64 Edition SP2

• Microsoft Security update for Windows Server 2003 x64 Edition(KB923561)
  http://www.microsoft.com/downloads/details.aspx?familyid=323f4211-5add -4e02-bce1-e5a1b489982c

Microsoft Word 2000 SP3

• Microsoft Security Update for Office 2000 (KB921606)
  http://www.microsoft.com/downloads/details.aspx?familyid=95876927-e612 -414c-bdec-3632a3100415&displaylang=en

Microsoft Word 2000 SP2

• Microsoft Security Update for Office 2000 (KB921606)
  http://www.microsoft.com/downloads/details.aspx?familyid=95876927-e612 -414c-bdec-3632a3100415&displaylang=en

Microsoft Windows XP Tablet PC Edition SP2

• Microsoft Security Update for Windows XP (KB923561)
  http://www.microsoft.com/downloads/details.aspx?familyid=50a8519a-503e -43dd-a78a-c1bc764fd213

Microsoft Windows XP Media Center Edition SP3

• Microsoft Security Update for Windows XP (KB923561)
  http://www.microsoft.com/downloads/details.aspx?familyid=50a8519a-503e -43dd-a78a-c1bc764fd213

Microsoft Windows Server 2003 Web Edition SP2

• Microsoft Security Update for Windows Server 2003 (KB923561)
  http://www.microsoft.com/downloads/details.aspx?familyid=2233a4d2-7c8a -4c89-b020-100d9afb43c8

Microsoft Word 2000 SR1a

• Microsoft Security Update for Office 2000 (KB921606)
  http://www.microsoft.com/downloads/details.aspx?familyid=95876927-e612 -414c-bdec-3632a3100415&displaylang=en

Microsoft Windows Server 2003 Standard Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB923561)
  http://www.microsoft.com/downloads/details.aspx?familyid=2233a4d2-7c8a -4c89-b020-100d9afb43c8

Microsoft Windows Server 2003 x64 SP1

• Microsoft Security update for Windows Server 2003 x64 Edition(KB923561)
  http://www.microsoft.com/downloads/details.aspx?familyid=323f4211-5add -4e02-bce1-e5a1b489982c

Microsoft Windows XP Professional x64 Edition SP2

• Microsoft Security update for Windows Server 2003 x64 Edition(KB923561)
  http://www.microsoft.com/downloads/details.aspx?familyid=323f4211-5add -4e02-bce1-e5a1b489982c

Microsoft Word 2000 SR1

• Microsoft Security Update for Office 2000 (KB921606)
  http://www.microsoft.com/downloads/details.aspx?familyid=95876927-e612 -414c-bdec-3632a3100415&displaylang=en

Microsoft Windows Server 2003 x64 SP2

• Microsoft Security update for Windows Server 2003 x64 Edition(KB923561)
  http://www.microsoft.com/downloads/details.aspx?familyid=323f4211-5add -4e02-bce1-e5a1b489982c

Microsoft Windows Server 2003 Enterprise x64 Edition

• Microsoft Security update for Windows Server 2003 x64 Edition(KB923561)
  http://www.microsoft.com/downloads/details.aspx?familyid=323f4211-5add -4e02-bce1-e5a1b489982c

Microsoft Windows XP Tablet PC Edition SP3

• Microsoft Security Update for Windows XP (KB923561)
  http://www.microsoft.com/downloads/details.aspx?familyid=50a8519a-503e -43dd-a78a-c1bc764fd213

Microsoft Windows Server 2003 Datacenter x64 Edition

• Microsoft Security update for Windows Server 2003 x64 Edition(KB923561)
  http://www.microsoft.com/downloads/details.aspx?familyid=323f4211-5add -4e02-bce1-e5a1b489982c

Microsoft Windows Server 2003 Enterprise Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB923561)
  http://www.microsoft.com/downloads/details.aspx?familyid=2233a4d2-7c8a -4c89-b020-100d9afb43c8

Microsoft Windows Server 2003 SP2

• Microsoft Security Update for Windows Server 2003 (KB923561)
  http://www.microsoft.com/downloads/details.aspx?familyid=2233a4d2-7c8a -4c89-b020-100d9afb43c8

Microsoft Word 2002

• Microsoft Security Update for Office XP (KB933399)
  http://www.microsoft.com/downloads/details.aspx?familyid=e1db55c6-78fb -498d-89a5-9ad54d971546&displaylang=en

Microsoft Word 2002 SP3

• Microsoft Security Update for Office XP (KB933399)
  http://www.microsoft.com/downloads/details.aspx?familyid=e1db55c6-78fb -498d-89a5-9ad54d971546&displaylang=en

Microsoft Windows Server 2003 Standard Edition SP2

• Microsoft Security Update for Windows Server 2003 (KB923561)
  http://www.microsoft.com/downloads/details.aspx?familyid=2233a4d2-7c8a -4c89-b020-100d9afb43c8

Microsoft Windows XP Home SP2

• Microsoft Security Update for Windows XP (KB923561)
  http://www.microsoft.com/downloads/details.aspx?familyid=50a8519a-503e -43dd-a78a-c1bc764fd213

Microsoft Windows Server 2003 SP1

• Microsoft Security Update for Windows Server 2003 (KB923561)
  http://www.microsoft.com/downloads/details.aspx?familyid=2233a4d2-7c8a -4c89-b020-100d9afb43c8

Microsoft Windows Server 2003 Itanium SP2

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB923561)
  http://www.microsoft.com/downloads/details.aspx?familyid=e840b9cb-f1f4 -482a-aa07-eb6b42b477c4

Microsoft Word 2002 SP1

• Microsoft Security Update for Office XP (KB933399)
  http://www.microsoft.com/downloads/details.aspx?familyid=e1db55c6-78fb -498d-89a5-9ad54d971546&displaylang=en

Microsoft Windows XP Professional x64 Edition

• Microsoft Security update for Windows Server 2003 x64 Edition(KB923561)
  http://www.microsoft.com/downloads/details.aspx?familyid=323f4211-5add -4e02-bce1-e5a1b489982c

Microsoft Windows Server 2003 Web Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB923561)
  http://www.microsoft.com/downloads/details.aspx?familyid=2233a4d2-7c8a -4c89-b020-100d9afb43c8

Microsoft Windows XP Home SP3

• Microsoft Security Update for Windows XP (KB923561)
  http://www.microsoft.com/downloads/details.aspx?familyid=50a8519a-503e -43dd-a78a-c1bc764fd213

Microsoft Windows XP Professional SP3

• Microsoft Security Update for Windows XP (KB923561)
  http://www.microsoft.com/downloads/details.aspx?familyid=50a8519a-503e -43dd-a78a-c1bc764fd213

Microsoft Windows XP Professional SP2

• Microsoft Security Update for Windows XP (KB923561)
  http://www.microsoft.com/downloads/details.aspx?familyid=50a8519a-503e -43dd-a78a-c1bc764fd213

Microsoft Windows Server 2003 Datacenter Edition Itanium SP1

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB923561)
  http://www.microsoft.com/downloads/details.aspx?familyid=e840b9cb-f1f4 -482a-aa07-eb6b42b477c4

Microsoft Windows Server 2003 Standard x64 Edition

• Microsoft Security update for Windows Server 2003 x64 Edition(KB923561)
  http://www.microsoft.com/downloads/details.aspx?familyid=323f4211-5add -4e02-bce1-e5a1b489982c

Microsoft Windows Server 2003 Enterprise x64 Edition SP2

• Microsoft Security update for Windows Server 2003 x64 Edition(KB923561)
  http://www.microsoft.com/downloads/details.aspx?familyid=323f4211-5add -4e02-bce1-e5a1b489982c

Microsoft Windows 2000 Professional SP4

• Microsoft Security Update for Windows 2000 (KB923561)
  http://www.microsoft.com/downloads/details.aspx?familyid=552d322a-5282 -42c7-9c1e-1d8c494a7318

Microsoft Word Bulleted List Handling Remote Memory Corruption Vulnerability

References:

• Microsoft Word Crash Video (Ivan Sanchez)
  
• Microsoft Word Crash Video 2 (Ivan Sanchez)
  
• Microsoft Word Homepage (Microsoft )
  
• MS09-010: Reducing the text converter attack surface (Microsoft Security Research & Defense)
  
• ASA-2009-131 MS09-010 Vulnerabilities in WordPad and Office Text Converters (Avaya)
  
• Microsoft Security Bulletin MS09-010 (Microsoft)