Microsoft Office Web Components ActiveX Control 'msDataSourceObject()' Code Execution Vulnerability

Bugtraq ID:	35642
Class:	Unknown
CVE:	CVE-2009-1136
Remote:	Yes
Local:	No
Published:	Jul 13 2009 12:00AM
Updated:	Aug 26 2009 10:02PM
Credit:	Haifei Li of Fortinet's FortiGuard Global Security Research Team and Peter Vreugdenhil of Zero Day Initiative
Vulnerable:	Microsoft Office XP Web Components SP3 Microsoft Office XP SP3 + Microsoft Excel 2002 SP3 + Microsoft Excel 2002 SP3 + Microsoft FrontPage 2002 SP3 + Microsoft FrontPage 2002 SP3 + Microsoft Outlook 2002 SP3 + Microsoft Outlook 2002 SP3 + Microsoft PowerPoint 2002 SP3 + Microsoft PowerPoint 2002 SP3 + Microsoft Publisher 2002 SP3 + Microsoft Publisher 2002 SP3 Microsoft Office XP SP2 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Microsoft Office XP SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Microsoft Office XP - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Microsoft Office 2003 Web Components for Office 2007 SP1 0 Microsoft Office 2003 Web Components SP3 Microsoft Office 2003 SP3 Microsoft Office 2003 SP2 Microsoft Office 2003 SP1 Microsoft Office 2003 0 + Microsoft Excel 2003 + Microsoft FrontPage 2003 + Microsoft InfoPath 2003 + Microsoft OneNote 2003 0 + Microsoft Outlook 2003 0 + Microsoft PowerPoint 2003 0 + Microsoft Publisher 2003 Microsoft Microsoft Office Small Business Accounting 2006 0 Microsoft Internet Security and Acceleration Server 2006 Supportability Up 0 Microsoft Internet Security and Acceleration Server 2006 SP1 Microsoft Internet Security and Acceleration Server 2006 0 Microsoft Internet Security and Acceleration Server 2004 Standard Edition SP3 Microsoft Internet Security and Acceleration Server 2004 Enterprise Editio SP3
Not Vulnerable:

Microsoft Office Web Components ActiveX Control 'msDataSourceObject()' Code Execution Vulnerability

Microsoft Office Web Components is prone to a remote code-execution vulnerability that affects the OWC10.Spreadsheet ActiveX control. The control is identified by the following CLSIDs:

0002E541-0000-0000-C000-000000000046
0002E559-0000-0000-C000-000000000046

An attacker could exploit this issue by enticing a victim to visit a maliciously crafted site.

Successfully exploiting this issue would allow the attacker to execute arbitrary code in the context of the currently logged-in user.

Microsoft Office Web Components ActiveX Control 'msDataSourceObject()' Code Execution Vulnerability

Exploits for this issue have been reported in the wild.

Exploits are available. Note that Symantec has not verified or tested these exploits.

• /data/vulnerabilities/exploits/35642.rb
• /data/vulnerabilities/exploits/35642.html
• /data/vulnerabilities/exploits/35642.py

Microsoft Office Web Components ActiveX Control 'msDataSourceObject()' Code Execution Vulnerability

Solution:
The vendor has released an advisory and fixes. Please see the references for details.


Microsoft Office XP SP3

• Microsoft Security Update for Microsoft Office XP Web Components (KB947320)
  http://www.microsoft.com/downloads/details.aspx?familyid=60e2e4e7-aa75 -441d-b6fc-7e850bf8e580

Microsoft Office 2003 Web Components SP3

• Microsoft Security Update for Microsoft Office Web Components (KB947319)
  http://www.microsoft.com/downloads/details.aspx?familyid=95c94c9a-6aca -42fb-9679-3234f06c72f7

Microsoft Office XP Web Components SP3

• Microsoft Security Update for Microsoft Office XP Web Components (KB947320)
  http://www.microsoft.com/downloads/details.aspx?familyid=60e2e4e7-aa75 -441d-b6fc-7e850bf8e580

Microsoft Office 2003 Web Components for Office 2007 SP1 0

• Microsoft Security Update for Microsoft Office 2003 Web Components for the 2007 Microsoft Office System (KB947
  http://www.microsoft.com/downloads/details.aspx?familyid=644008e0-77c9 -4a02-ac9b-e30d0930c4be

Microsoft Office 2003 SP3

• Microsoft Security Update for Microsoft Office Web Components (KB947319)
  http://www.microsoft.com/downloads/details.aspx?familyid=95c94c9a-6aca -42fb-9679-3234f06c72f7

Microsoft Microsoft Office Small Business Accounting 2006 0

• Microsoft Security Update for Microsoft Small Business Accounting 2006 Office Web Components (KB968377)
  http://www.microsoft.com/downloads/details.aspx?familyid=0d77ddb3-4d34 -4cfe-913b-d05981f59a82

Microsoft Office Web Components ActiveX Control 'msDataSourceObject()' Code Execution Vulnerability

References:

• Microsoft Homepage (Microsoft)
  
• Microsoft Knowledge Base Article 240797 (Microsoft)
  
• Microsoft Office Web Components Memory Corruption Vulnerability (Fortinet)
  
• Microsoft Security Advisory 973472 Released (Microsoft)
  
• More information about the Office Web Components ActiveX vulnerability (Fermin J. Serna)
  
• FortiGuard Advisory: Microsoft Office Web Components Remote Memory Corruption Vu ("[email protected]" )
  
• ZDI-09-054: Microsoft Office OWC10.Spreadsheet ActiveX msDataSourceObject() Heap (ZDI Disclosures )
  
• Microsoft Security Advisory (973472): Vulnerability in Microsoft Office Web Comp (Microsoft)
  
• Microsoft Security Bulletin MS09-043 (Microsoft)
  
• ZDI-09-054: Microsoft Office OWC10.Spreadsheet ActiveX msDataSourceObject() Heap (Zero Day Initiative)