Microsoft PowerPoint Invalid Record Type Remote Code Execution Vulnerability

Bugtraq ID:	34879
Class:	Boundary Condition Error
CVE:	CVE-2009-0224
Remote:	Yes
Local:	No
Published:	May 12 2009 12:00AM
Updated:	Jun 09 2009 10:39PM
Credit:	Sean Larsson of VeriSign iDefense Labs
Vulnerable:	Microsoft Works 9.0 Microsoft Works 8.5 Microsoft PowerPoint Viewer 2007 SP2 Microsoft PowerPoint Viewer 2007 SP1 Microsoft PowerPoint Viewer 2007 0 Microsoft PowerPoint Viewer 2003 SP3 Microsoft PowerPoint 2007 SP2 Microsoft PowerPoint 2007 SP1 Microsoft PowerPoint 2007 0 Microsoft PowerPoint 2003 SP3 + Microsoft Office 2003 SP3 Microsoft PowerPoint 2003 SP2 + Microsoft Office 2003 SP2 Microsoft PowerPoint 2003 SP1 + Microsoft Office 2003 SP1 Microsoft PowerPoint 2003 0 + Microsoft Office 2003 0 Microsoft PowerPoint 2002 SP3 Microsoft PowerPoint 2002 SP2 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Microsoft PowerPoint 2002 SP1 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services - Microsoft Windows ME - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 Microsoft PowerPoint 2002 + Microsoft Office XP - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services - Microsoft Windows 95 SR2 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 Microsoft PowerPoint 2000 SP3 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Microsoft PowerPoint 2000 SR1 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 Microsoft PowerPoint 2000 SP2 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 Microsoft Open XML File Format Converter for Mac 0 Microsoft Office Compatibility Pack 2007 SP2 Microsoft Office Compatibility Pack 2007 SP1 Microsoft Office Compatibility Pack 2007 0 Microsoft Office 2008 for Mac 0 Microsoft Office 2004 for Mac 0
Not Vulnerable:

Microsoft PowerPoint Invalid Record Type Remote Code Execution Vulnerability

Microsoft PowerPoint is prone to a remote code-execution vulnerability.

An attacker can exploit this issue by enticing a victim to open a malicious PowerPoint file.

Successfully exploiting this issue can allow the attacker to execute arbitrary code in the context of the currently logged-in user.

Microsoft PowerPoint Invalid Record Type Remote Code Execution Vulnerability

A working commercial exploit is available through VUPEN Security - Exploit and PoCs Service. This exploit is not otherwise publicly available or known to be circulating in the wild.

Microsoft PowerPoint Invalid Record Type Remote Code Execution Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for details.


Microsoft PowerPoint 2002 SP3

• Microsoft Security Update for Microsoft PowerPoint 2002 (KB957781)
  http://www.microsoft.com/downloads/details.aspx?familyid=a24ec7ab-c1c7 -4ddb-8b6e-107f1af67f49

Microsoft Office 2008 for Mac 0

• Microsoft Microsoft Office 2008 for Mac 12.1.9 Update
  http://www.microsoft.com/downloads/details.aspx?FamilyID=58326da2-eb75 -4b42-b1bc-e70319defb58

Microsoft PowerPoint 2007 SP1

• Microsoft Security Update for Microsoft PowerPoint 2007 (KB957789)
  http://www.microsoft.com/downloads/details.aspx?familyid=11f8380f-ffb6 -4c22-a89c-3dc55d0f9834

Microsoft Works 9.0

• Microsoft Security Update for Microsoft Works 9 (KB967044)
  http://www.microsoft.com/downloads/details.aspx?familyid=f6fa110e-45c6 -450f-ae47-c89a06e3f762

Microsoft PowerPoint 2000 SP3

• Microsoft Security Update for Microsoft PowerPoint 2000 (KB957790)
  http://www.microsoft.com/downloads/details.aspx?familyid=f443312a-ac74 -4ebc-a4ac-7a756aa67894

Microsoft Office Compatibility Pack 2007 SP2

• Microsoft Security Update for the 2007 Microsoft Office System (KB969618)
  http://www.microsoft.com/downloads/details.aspx?familyid=e1d3a4c3-538a -4f98-8d60-250803a80e2a

Microsoft PowerPoint 2003 SP3

• Microsoft Security Update for Microsoft PowerPoint 2003 (KB957784)
  http://www.microsoft.com/downloads/details.aspx?familyid=ccfa978b-3340 -40db-a45d-c880ba36b106

Microsoft PowerPoint 2007 SP2

• Microsoft Security Update for Microsoft PowerPoint 2007 (KB957789)
  http://www.microsoft.com/downloads/details.aspx?familyid=11f8380f-ffb6 -4c22-a89c-3dc55d0f9834

Microsoft Office Compatibility Pack 2007 SP1

• Microsoft Security Update for the 2007 Microsoft Office System (KB969618)
  http://www.microsoft.com/downloads/details.aspx?familyid=e1d3a4c3-538a -4f98-8d60-250803a80e2a

Microsoft Open XML File Format Converter for Mac 0

• Microsoft Open XML File Format Converter for Mac 1.0.3
  http://www.microsoft.com/downloads/details.aspx?FamilyID=9d6d9eaa-8442 -4184-8886-faab2803bde6

Microsoft Works 8.5

• Microsoft Security Update for Microsoft Works 8 (KB967043)
  http://www.microsoft.com/downloads/details.aspx?familyid=628280fe-e035 -4274-85f2-393d9bad543c

Microsoft Office 2004 for Mac 0

• Microsoft Microsoft Office 2004 for Mac 11.5.5 Update
  http://www.microsoft.com/downloads/details.aspx?FamilyID=5557bfb7-ebb4 -4c42-8042-41e830c4e550

Microsoft PowerPoint Viewer 2007 SP1

• Microsoft Security Update for PowerPoint Viewer 2007 (KB970059)
  http://www.microsoft.com/downloads/details.aspx?familyid=141b8338-5c52 -4326-a9e4-d2f2d8940d9c

Microsoft PowerPoint Viewer 2007 SP2

• Microsoft Security Update for PowerPoint Viewer 2007 (KB970059)
  http://www.microsoft.com/downloads/details.aspx?familyid=141b8338-5c52 -4326-a9e4-d2f2d8940d9c

Microsoft PowerPoint Invalid Record Type Remote Code Execution Vulnerability

References:

• Microsoft PowerPoint Build List Memory Corruption Vulnerability (iDefense Labs)
  
• Microsoft PowerPoint Homepage (Microsoft)
  
• iDefense Security Advisory 05.12.09: Microsoft PowerPoint Build List Memory Corr (iDefense Labs )
  
• Microsoft Security Bulletin MS09-017 (Microsoft)