Microsoft Publisher Object Handler Data Pointer Dereference Remote Code Execution Vulnerability

Bugtraq ID:	35599
Class:	Unknown
CVE:	CVE-2009-0566
Remote:	Yes
Local:	No
Published:	Jul 14 2009 12:00AM
Updated:	Jul 22 2009 07:56PM
Credit:	Lionel d'Hauenens of Labo Skopia working with VeriSign iDefense Labs
Vulnerable:	Microsoft Publisher 2007 SP1 Microsoft Publisher 2007 0
Not Vulnerable:

Microsoft Publisher Object Handler Data Pointer Dereference Remote Code Execution Vulnerability

Microsoft Publisher is prone to a remote code-execution vulnerability.

An attacker can exploit this issue by enticing a victim to open a malicious Publisher file.

Successfully exploiting this issue would allow the attacker to execute arbitrary code in the context of the currently logged-in user.

Microsoft Publisher Object Handler Data Pointer Dereference Remote Code Execution Vulnerability

A working commercial exploit is available through VUPEN Security - Exploit and PoCs Service. This exploit is not otherwise publicly available or known to be circulating in the wild.

Microsoft Publisher Object Handler Data Pointer Dereference Remote Code Execution Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for details.


Microsoft Publisher 2007 SP1

• Microsoft Security Update for Microsoft Office Publisher 2007 (KB969693)
  http://www.microsoft.com/downloads/details.aspx?familyid=d4b0665d-5744 -49c7-a3c0-f231fd08d3b8

Microsoft Publisher Object Handler Data Pointer Dereference Remote Code Execution Vulnerability

References:

• Microsoft Office Publisher 2007 Arbitrary Pointer Dereference Vulnerability (iDefense Labs)
  
• Publisher Homepage (Microsoft)
  
• iDefense Security Advisory 07.15.09: Microsoft Office Publisher 2007 Arbitrary P (iDefense Labs )
  
• Microsoft Security Bulletin MS09-030 (Microsoft)