Microsoft Office Works for Windows Document Converters Remote Code Execution Vulnerability

Bugtraq ID:	35184
Class:	Boundary Condition Error
CVE:	CVE-2009-1533
Remote:	Yes
Local:	No
Published:	Jun 09 2009 12:00AM
Updated:	Jun 17 2009 01:59PM
Credit:	Shaun Colley of NGS Software
Vulnerable:	Microsoft Works 9.0 Microsoft Works 8.5 Microsoft Office XP SP3 + Microsoft Excel 2002 SP3 + Microsoft Excel 2002 SP3 + Microsoft FrontPage 2002 SP3 + Microsoft FrontPage 2002 SP3 + Microsoft Outlook 2002 SP3 + Microsoft Outlook 2002 SP3 + Microsoft PowerPoint 2002 SP3 + Microsoft PowerPoint 2002 SP3 + Microsoft Publisher 2002 SP3 + Microsoft Publisher 2002 SP3 Microsoft Office 2007 SP1 Microsoft Office 2003 SP3 Microsoft Office 2000 SP3 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional
Not Vulnerable:

Microsoft Office Works for Windows Document Converters Remote Code Execution Vulnerability

Microsoft Office Works for Windows document converters are prone to a remote code-execution vulnerability because the application fails to properly handle specially crafted files.

An attacker could exploit this issue by enticing a victim to open a malicious '.wps' file.

Successful exploits would allow the attacker to execute arbitrary code in the context of the currently logged-in user.

Microsoft Office Works for Windows Document Converters Remote Code Execution Vulnerability

A working commercial exploit is available through VUPEN Security - Exploit and PoCs Service. This exploit is not otherwise publicly available or known to be circulating in the wild.

A working commercial exploit is available from SAINT Corporation. This exploit is not otherwise publicly available or known to be circulating in the wild.

Microsoft Office Works for Windows Document Converters Remote Code Execution Vulnerability

Solution:
The vendor has released an advisory and updates to address this issue. Please see the references for details.


Microsoft Works 8.5

• Microsoft Security Update for Microsoft Works 8 (KB967043)
  http://www.microsoft.com/downloads/details.aspx?familyid=628280fe-e035 -4274-85f2-393d9bad543c

Microsoft Works 9.0

• Microsoft Security Update for Microsoft Works 9 (KB967044)
  http://www.microsoft.com/downloads/details.aspx?familyid=f6fa110e-45c6 -450f-ae47-c89a06e3f762

Microsoft Office Works for Windows Document Converters Remote Code Execution Vulnerability

References:

• Microsoft Office Product Homepage (Microsoft)
  
• Microsoft Works Homepage (Microsoft )
  
• Security Research & Defense : MS09-024: Lower risk if you have Microsoft Word in (Greg Wroblewski)
  
• Microsoft Security Bulletin MS09-024 (Microsoft)