Microsoft PowerPoint Freelance Layout Parsing Heap Based Buffer Overflow Vulnerability

Bugtraq ID:	35275
Class:	Boundary Condition Error
CVE:	CVE-2009-0202
Remote:	Yes
Local:	No
Published:	Jun 10 2009 12:00AM
Updated:	Jun 10 2009 08:19PM
Credit:	Carsten Eiram, Secunia Research
Vulnerable:	Microsoft PowerPoint 2002 + Microsoft Office XP - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services - Microsoft Windows 95 SR2 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 Microsoft PowerPoint 2000 + Microsoft Office 2000 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3
Not Vulnerable:

Microsoft PowerPoint Freelance Layout Parsing Heap Based Buffer Overflow Vulnerability

Microsoft PowerPoint is prone to a heap-based buffer-overflow vulnerability.

An attacker can exploit this issue by enticing a victim to open a malicious Freelance file.

Successful exploits can allow the attacker to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely cause denial-of-service conditions.

Microsoft PowerPoint Freelance Layout Parsing Heap Based Buffer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft PowerPoint Freelance Layout Parsing Heap Based Buffer Overflow Vulnerability

Solution:
Reportedly, updates from the MS09-017 disable support for Freelance files. Symantec has note confirmed this information.

Microsoft PowerPoint Freelance Layout Parsing Heap Based Buffer Overflow Vulnerability

References:

• Microsoft PowerPoint Homepage (Microsoft)
  
• Secunia Research: Microsoft PowerPoint Freelance Layout Parsing Vulnerability (Secunia Research )
  
• Microsoft Security Bulletin MS09-017 (Microsoft)
  
• Secunia Research: Microsoft PowerPoint Freelance Layout Parsing Vulnerability (Secunia Research)