BID:35991

Microsoft OWC ActiveX Control 'BorderAround()' Heap Corruption Remote Code Execution Vulnerability

Info

Microsoft OWC ActiveX Control 'BorderAround()' Heap Corruption Remote Code Execution Vulnerability

Bugtraq ID:	35991
Class:	Unknown
CVE:	CVE-2009-2496
Remote:	Yes
Local:	No
Published:	Aug 11 2009 12:00AM
Updated:	Aug 26 2009 10:52PM
Credit:	Peter Vreugdenhil of Zero Day Initiative
Vulnerable:	Microsoft Office XP Web Components SP3 Microsoft Office XP SP3 + Microsoft Excel 2002 SP3 + Microsoft Excel 2002 SP3 + Microsoft FrontPage 2002 SP3 + Microsoft FrontPage 2002 SP3 + Microsoft Outlook 2002 SP3 + Microsoft Outlook 2002 SP3 + Microsoft PowerPoint 2002 SP3 + Microsoft PowerPoint 2002 SP3 + Microsoft Publisher 2002 SP3 + Microsoft Publisher 2002 SP3 Microsoft Office XP SP2 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Microsoft Office XP SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Microsoft Office XP - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Microsoft Office Small Business Accounting 2006 0 Microsoft Office 2003 Web Components for Office 2007 SP1 0 Microsoft Office 2003 Web Components SP3 Microsoft Office 2003 SP3 Microsoft Office 2003 SP2 Microsoft Office 2003 SP1 Microsoft Office 2003 0 + Microsoft Excel 2003 + Microsoft FrontPage 2003 + Microsoft InfoPath 2003 + Microsoft OneNote 2003 0 + Microsoft Outlook 2003 0 + Microsoft PowerPoint 2003 0 + Microsoft Publisher 2003 Microsoft Microsoft Office Small Business Accounting 2006 0 Microsoft Internet Security and Acceleration Server 2006 Supportability Up 0 Microsoft Internet Security and Acceleration Server 2006 SP1 Microsoft Internet Security and Acceleration Server 2006 0 Microsoft Internet Security and Acceleration Server 2004 Standard Edition SP3 Microsoft Internet Security and Acceleration Server 2004 Enterprise Editio SP3

Not Vulnerable:

Discussion

Microsoft OWC ActiveX Control 'BorderAround()' Heap Corruption Remote Code Execution Vulnerability

Microsoft Office Web Components ActiveX control is prone to a remote code-execution vulnerability.

An attacker could exploit this issue by enticing a victim to visit a maliciously crafted webpage.

Successful exploits will allow the attacker to execute arbitrary code within the context of an affected application that uses the ActiveX control (typically Internet Explorer). Failed exploit attempts will result in a denial-of-service condition.

Exploit / POC

Microsoft OWC ActiveX Control 'BorderAround()' Heap Corruption Remote Code Execution Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Solution / Fix

Microsoft OWC ActiveX Control 'BorderAround()' Heap Corruption Remote Code Execution Vulnerability

Solution:
The vendor has released an advisory and fixes. Please see the references for details.

Microsoft Office XP SP3

Microsoft Security Update for Microsoft Office XP Web Components (KB947320)
http://www.microsoft.com/downloads/details.aspx?familyid=60e2e4e7-aa75 -441d-b6fc-7e850bf8e580

Microsoft Office 2003 Web Components SP3

Microsoft Security Update for Microsoft Office Web Components (KB947319)
http://www.microsoft.com/downloads/details.aspx?familyid=95c94c9a-6aca -42fb-9679-3234f06c72f7

Microsoft Office XP Web Components SP3

Microsoft Security Update for Microsoft Office XP Web Components (KB947320)
http://www.microsoft.com/downloads/details.aspx?familyid=60e2e4e7-aa75 -441d-b6fc-7e850bf8e580

Microsoft Office 2003 Web Components for Office 2007 SP1 0

Microsoft Security Update for Microsoft Office 2003 Web Components for the 2007 Microsoft Office System (KB947
http://www.microsoft.com/downloads/details.aspx?familyid=644008e0-77c9 -4a02-ac9b-e30d0930c4be

Microsoft Office 2003 SP3

Microsoft Security Update for Microsoft Office Web Components (KB947319)
http://www.microsoft.com/downloads/details.aspx?familyid=95c94c9a-6aca -42fb-9679-3234f06c72f7

Microsoft Office Small Business Accounting 2006 0

Microsoft Security Update for Microsoft Small Business Accounting 2006 Office Web Components (KB968377)
http://www.microsoft.com/downloads/details.aspx?familyid=0d77ddb3-4d34 -4cfe-913b-d05981f59a82

Microsoft Microsoft Office Small Business Accounting 2006 0

Microsoft Security Update for Microsoft Small Business Accounting 2006 Office Web Components (KB968377)
http://www.microsoft.com/downloads/details.aspx?familyid=0d77ddb3-4d34 -4cfe-913b-d05981f59a82

References

Microsoft OWC ActiveX Control 'BorderAround()' Heap Corruption Remote Code Execution Vulnerability

References:

Microsoft Homepage (Microsoft)
Microsoft Knowledge Base Article 240797 (Microsoft)
Microsoft Office OWC10.Spreadsheet ActiveX BorderAround() Heap Corruption Vulner (TippingPoint)
ZDI-09-056: Microsoft Office OWC10.Spreadsheet ActiveX BorderAround() Heap Corru (ZDI Disclosures )
Microsoft Security Bulletin MS09-043 (Microsoft)