BID:35245

Microsoft Excel Malformed Shared String Table Record Integer Overflow Vulnerability

Info

Microsoft Excel Malformed Shared String Table Record Integer Overflow Vulnerability

Bugtraq ID:	35245
Class:	Unknown
CVE:	CVE-2009-0561
Remote:	Yes
Local:	No
Published:	Jun 09 2009 12:00AM
Updated:	Jun 16 2009 05:29PM
Credit:	Sean Larsson and Joshua Drake from VeriSign iDefense Labs; Carsten H. Eiram from Secunia
Vulnerable:	Microsoft SharePoint Server 2007 x64 SP2 Microsoft SharePoint Server 2007 x64 SP1 Microsoft SharePoint Server 2007 x64 0 Microsoft SharePoint Server 2007 SP2 Microsoft SharePoint Server 2007 SP1 Microsoft SharePoint Server 2007 0 Microsoft Open XML File Format Converter for Mac 0 Microsoft Office Excel Viewer 2003 0 Microsoft Office Excel Viewer 2003 SP3 Microsoft Office Compatibility Pack 2007 SP2 Microsoft Office Compatibility Pack 2007 SP1 Microsoft Office Compatibility Pack 2007 0 Microsoft Excel Viewer 2003 SP3 Microsoft Excel Viewer 2003 0 + Microsoft Office 2003 SP1 + Microsoft Office 2003 SP1 + Microsoft Office 2003 SP1 Microsoft Excel Viewer SP3 Microsoft Excel Viewer 0 Microsoft Excel 2008 for Mac 0 Microsoft Excel 2007 SP2 Microsoft Excel 2007 SP1 Microsoft Excel 2007 0 Microsoft Excel 2007 0 Microsoft Excel 2004 for Mac 0 Microsoft Excel 2003 SP3 Microsoft Excel 2003 SP2 Microsoft Excel 2003 SP1 + Microsoft Office 2003 SP1 Microsoft Excel 2003 + Microsoft Office 2003 0 Microsoft Excel 2002 SP3 + Microsoft Office XP SP3 Microsoft Excel 2002 SP2 + Microsoft Office XP SP2 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Microsoft Excel 2002 SP1 + Microsoft Office XP SP1 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Microsoft Excel 2002 + Microsoft Office XP - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 SR2 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Microsoft Excel 2000 SR1 + Microsoft Office 2000 SP1 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 Microsoft Excel 2000 SP3 + Microsoft Office 2000 SP3 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Microsoft Excel 2000 SP2 + Microsoft Office 2000 SP2 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 Microsoft Excel 2000 0 Microsoft Excel 2000 + Microsoft Office 2000 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0

Not Vulnerable:

Discussion

Microsoft Excel Malformed Shared String Table Record Integer Overflow Vulnerability

Microsoft Excel is prone to an integer-overflow vulnerability.

Attackers may exploit this issue by enticing victims into opening a maliciously crafted Excel file.

Successful exploits may allow attackers to execute arbitrary code with the privileges of the user running the application.

Exploit / POC

Microsoft Excel Malformed Shared String Table Record Integer Overflow Vulnerability

A working commercial exploit is available through VUPEN Security - Exploit and PoCs Service. This exploit is not otherwise publicly available or known to be circulating in the wild.

Solution / Fix

Microsoft Excel Malformed Shared String Table Record Integer Overflow Vulnerability

Solution:
The vendor has released a security bulletin along with fixes. Please see the references for details.

Microsoft Excel 2003 SP3

Microsoft Security Update for Microsoft Office Excel 2003 (KB969681)
http://www.microsoft.com/downloads/details.aspx?familyid=10156044-a5a4 -4312-98a7-1b1ced625ddb

Microsoft Office Compatibility Pack 2007 SP1

Microsoft Security Update for the 2007 Microsoft Office System (KB969679)
http://www.microsoft.com/downloads/details.aspx?familyid=a8be8457-b0b6 -455e-907e-d13be883adf2

Microsoft Open XML File Format Converter for Mac 0

Microsoft Open XML File Format Converter for Mac 1.0.3
http://www.microsoft.com/downloads/details.aspx?FamilyID=9d6d9eaa-8442 -4184-8886-faab2803bde6

Microsoft Excel 2002 SP3

Microsoft Security Update for Microsoft Excel 2002 (KB969680)
http://www.microsoft.com/downloads/details.aspx?familyid=dd80ce95-0aec -4493-b9d1-c3dad95c3415

Microsoft Excel 2007 SP2

Microsoft Security Update for Microsoft Office Excel 2007 (KB969682)
http://www.microsoft.com/downloads/details.aspx?familyid=2bcd565a-6acb -407d-80da-0398526ddf99

Microsoft SharePoint Server 2007 SP1

Microsoft Security Update for Excel Services for Microsoft Office SharePoint Server 2007 (KB969737), 32-bit Ed
http://www.microsoft.com/downloads/details.aspx?familyid=862e6ad1-8124 -4060-93b1-2b882ef5ce3d

Microsoft Excel Viewer 2003 SP3

Microsoft Security Update for Microsoft Office Excel Viewer 2003 (KB969685)
http://www.microsoft.com/downloads/details.aspx?familyid=20e6933d-85f8 -4cec-9534-893789cd053e

Microsoft SharePoint Server 2007 x64 SP2

Microsoft Security Update for Excel Services for Microsoft Office SharePoint Server 2007 (KB969737), 64-bit Ed
http://www.microsoft.com/downloads/details.aspx?familyid=b7b6e611-2c5d -4639-add9-972055789ecd

Microsoft Office Excel Viewer 2003 SP3

Microsoft Security Update for Microsoft Office Excel Viewer 2003 (KB969685)
http://www.microsoft.com/downloads/details.aspx?familyid=20e6933d-85f8 -4cec-9534-893789cd053e

Microsoft SharePoint Server 2007 SP2

Microsoft Security Update for Excel Services for Microsoft Office SharePoint Server 2007 (KB969737), 32-bit Ed
http://www.microsoft.com/downloads/details.aspx?familyid=862e6ad1-8124 -4060-93b1-2b882ef5ce3d

Microsoft Office Compatibility Pack 2007 SP2

Microsoft Security Update for the 2007 Microsoft Office System (KB969679)
http://www.microsoft.com/downloads/details.aspx?familyid=a8be8457-b0b6 -455e-907e-d13be883adf2

Microsoft Excel Viewer 0

Microsoft Security Update for Microsoft Office Excel Viewer (KB969686)
http://www.microsoft.com/downloads/details.aspx?familyid=ac0530dc-7f63 -4ad0-85c1-784ad28156cf

Microsoft Excel 2007 SP1

Microsoft Security Update for Microsoft Office Excel 2007 (KB969682)
http://www.microsoft.com/downloads/details.aspx?familyid=2bcd565a-6acb -407d-80da-0398526ddf99

Microsoft SharePoint Server 2007 x64 SP1

Microsoft Security Update for Excel Services for Microsoft Office SharePoint Server 2007 (KB969737), 64-bit Ed
http://www.microsoft.com/downloads/details.aspx?familyid=b7b6e611-2c5d -4639-add9-972055789ecd

Microsoft Excel 2000 SP3

Microsoft Security Update for Microsoft Excel 2000 (KB969683)
http://www.microsoft.com/downloads/details.aspx?familyid=dd16e243-b8e2 -4afb-86b6-4d60214598eb

References

Microsoft Excel Malformed Shared String Table Record Integer Overflow Vulnerability

References:

Microsoft Excel Homepage (Microsoft )
Microsoft Excel SST Record Integer Overflow Vulnerability (iDefense Labs)
Secunia Research: Microsoft Excel String Parsing Integer Overflow Vulnerability (Secunia Research )
Microsoft Security Bulletin MS09-021 (Microsoft)