Microsoft Word Record Parsing Buffer Overflow Vulnerability

Bugtraq ID:	35190
Class:	Boundary Condition Error
CVE:	CVE-2009-0565
Remote:	Yes
Local:	No
Published:	Jun 09 2009 12:00AM
Updated:	Jun 22 2009 08:49PM
Credit:	Nicolas Joly of VUPEN Security
Vulnerable:	Microsoft Word 2007 SP2 Microsoft Word 2007 SP1 Microsoft Word 2002 SP3 Microsoft Word 2000 SP3 + Microsoft Office 2000 SP3 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Microsoft Open XML File Format Converter for Mac 0 Microsoft Office Compatibility Pack 2007 SP2 Microsoft Office Compatibility Pack 2007 SP1 Microsoft Office 2008 for Mac 0 Microsoft Office 2004 for Mac 0
Not Vulnerable:

Microsoft Word Record Parsing Buffer Overflow Vulnerability

Microsoft Word is prone to a buffer-overflow vulnerability.

An attacker can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial-of-service conditions.

Microsoft Word Record Parsing Buffer Overflow Vulnerability

A working commercial exploit is available through VUPEN Security - Exploit and PoCs Service. This exploit is not otherwise publicly available or known to be circulating in the wild.

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

Microsoft Word Record Parsing Buffer Overflow Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the referenced advisory for details.


Microsoft Open XML File Format Converter for Mac 0

• Microsoft Open XML File Format Converter for Mac 1.0.3
  http://www.microsoft.com/downloads/details.aspx?FamilyID=9d6d9eaa-8442 -4184-8886-faab2803bde6

Microsoft Office 2008 for Mac 0

• Microsoft Microsoft Office 2008 for Mac 12.1.9 Update
  http://www.microsoft.com/downloads/details.aspx?FamilyID=58326da2-eb75 -4b42-b1bc-e70319defb58

Microsoft Word 2007 SP2

• Microsoft Security Update for Microsoft Office Word 2007 (KB969604)
  http://www.microsoft.com/downloads/details.aspx?familyid=7e205108-4c28 -4cab-a4d0-4ed3fd696473

Microsoft Office 2004 for Mac 0

• Microsoft Microsoft Office 2004 for Mac 11.5.5 Update
  http://www.microsoft.com/downloads/details.aspx?FamilyID=5557bfb7-ebb4 -4c42-8042-41e830c4e550

Microsoft Word 2000 SP3

• Microsoft Security Update for Microsoft Word 2000 (KB969600)
  http://www.microsoft.com/downloads/details.aspx?familyid=3663e9f2-a952 -4238-b902-90b5b09feb38

Microsoft Office Compatibility Pack 2007 SP2

• Microsoft Security Update for the 2007 Microsoft Office System (KB969613)
  http://www.microsoft.com/downloads/details.aspx?familyid=63bd8f14-e736 -46ce-af66-d30f17461e5a

Microsoft Word 2002 SP3

• Microsoft Security Update for Microsoft Word 2002 (KB969602)
  http://www.microsoft.com/downloads/details.aspx?familyid=f1323be1-15f2 -491b-abae-c03ba1394398

Microsoft Word 2007 SP1

• Microsoft Security Update for Microsoft Office Word 2007 (KB969604)
  http://www.microsoft.com/downloads/details.aspx?familyid=7e205108-4c28 -4cab-a4d0-4ed3fd696473

Microsoft Office Compatibility Pack 2007 SP1

• Microsoft Security Update for the 2007 Microsoft Office System (KB969613)
  http://www.microsoft.com/downloads/details.aspx?familyid=63bd8f14-e736 -46ce-af66-d30f17461e5a

Microsoft Word Record Parsing Buffer Overflow Vulnerability

References:

• Microsoft Office Product Homepage (Microsoft)
  
• VUPEN Security - Microsoft Office Word Document Parsing Buffer Overflow Vulnerab ("VUPEN Security Research" )
  
• Microsoft Security Bulletin MS09-027 (Microsoft)