Microsoft Word Record Parsing Length Field Remote Stack Buffer Overflow Vulnerability

Bugtraq ID:	35188
Class:	Boundary Condition Error
CVE:	CVE-2009-0563
Remote:	Yes
Local:	No
Published:	Jun 09 2009 12:00AM
Updated:	Aug 20 2010 09:23AM
Credit:	Wushi of team509
Vulnerable:	Microsoft Word Viewer 2003 SP3 Microsoft Word 2007 SP2 Microsoft Word 2007 SP1 Microsoft Word 2003 SP3 Microsoft Word 2002 SP3 Microsoft Open XML File Format Converter for Mac 0 Microsoft Office Word Viewer 0 Microsoft Office Compatibility Pack 2007 SP2 Microsoft Office Compatibility Pack 2007 SP1 Microsoft Office 2008 for Mac 0 Microsoft Office 2004 for Mac 0
Not Vulnerable:

Microsoft Word Record Parsing Length Field Remote Stack Buffer Overflow Vulnerability

Microsoft Word is prone to a stack-based buffer-overflow vulnerability.

An attacker can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial-of-service conditions.

Microsoft Word Record Parsing Length Field Remote Stack Buffer Overflow Vulnerability

The following exploit code is available:

• /data/vulnerabilities/exploits/35188.py

Microsoft Word Record Parsing Length Field Remote Stack Buffer Overflow Vulnerability

Solution:
The vendor has released an advisory and updates to address this issue. Please see the referenced advisory for details.


Microsoft Open XML File Format Converter for Mac 0

• Microsoft Open XML File Format Converter for Mac 1.0.3
  http://www.microsoft.com/downloads/details.aspx?FamilyID=9d6d9eaa-8442 -4184-8886-faab2803bde6

Microsoft Word 2003 SP3

• Microsoft Security Update for Microsoft Office Word 2003 (KB969603)
  http://www.microsoft.com/downloads/details.aspx?familyid=7cbc2587-2c8c -49b4-9f40-e4cdccb61ecd

Microsoft Office 2008 for Mac 0

• Microsoft Microsoft Office 2008 for Mac 12.1.9 Update
  http://www.microsoft.com/downloads/details.aspx?FamilyID=58326da2-eb75 -4b42-b1bc-e70319defb58

Microsoft Word 2007 SP2

• Microsoft Security Update for Microsoft Office Word 2007 (KB969604)
  http://www.microsoft.com/downloads/details.aspx?familyid=7e205108-4c28 -4cab-a4d0-4ed3fd696473

Microsoft Office 2004 for Mac 0

• Microsoft Microsoft Office 2004 for Mac 11.5.5 Update
  http://www.microsoft.com/downloads/details.aspx?FamilyID=5557bfb7-ebb4 -4c42-8042-41e830c4e550

Microsoft Office Compatibility Pack 2007 SP2

• Microsoft Security Update for the 2007 Microsoft Office System (KB969613)
  http://www.microsoft.com/downloads/details.aspx?familyid=63bd8f14-e736 -46ce-af66-d30f17461e5a

Microsoft Word 2002 SP3

• Microsoft Security Update for Microsoft Word 2002 (KB969602)
  http://www.microsoft.com/downloads/details.aspx?familyid=f1323be1-15f2 -491b-abae-c03ba1394398

Microsoft Office Word Viewer 0

• Microsoft Security Update for Microsoft Office Word Viewer 2003 (KB969614)
  http://www.microsoft.com/downloads/details.aspx?familyid=82980a40-f10c -4f02-b06c-3a12d4434a6b

Microsoft Word 2007 SP1

• Microsoft Security Update for Microsoft Office Word 2007 (KB969604)
  http://www.microsoft.com/downloads/details.aspx?familyid=7e205108-4c28 -4cab-a4d0-4ed3fd696473

Microsoft Office Compatibility Pack 2007 SP1

• Microsoft Security Update for the 2007 Microsoft Office System (KB969613)
  http://www.microsoft.com/downloads/details.aspx?familyid=63bd8f14-e736 -46ce-af66-d30f17461e5a

Microsoft Word Record Parsing Length Field Remote Stack Buffer Overflow Vulnerability

References:

• Microsoft Office Product Homepage (Microsoft)
  
• Microsoft Word Document Stack Based Buffer Overflow Vulnerability (Zero Day Initiative)
  
• ZDI-09-035: Microsoft Word Document Stack Based Buffer Overflow Vulnerability (ZDI Disclosures )
  
• Microsoft Security Bulletin MS09-027 (Microsoft)