Microsoft Word Record Parsing Remote Stack Buffer Overflow Vulnerability

Bugtraq ID:	36950
Class:	Boundary Condition Error
CVE:	CVE-2009-3135
Remote:	Yes
Local:	No
Published:	Nov 10 2009 12:00AM
Updated:	Nov 23 2009 05:15PM
Credit:	Jun Mao
Vulnerable:	Microsoft Word Viewer 2003 SP3 Microsoft Word 2003 SP3 Microsoft Word 2002 SP3 Microsoft Open XML File Format Converter for Mac 0 Microsoft Office Word Viewer 0 Microsoft Office 2008 for Mac 0 Microsoft Office 2004 for Mac 0
Not Vulnerable:

Microsoft Word Record Parsing Remote Stack Buffer Overflow Vulnerability

Microsoft Word is prone to a remote stack-buffer overflow vulnerability.

Attackers can exploit this issue by enticing victims into opening a specially crafted Word ('.doc') file.

Successful exploits can allow attackers to execute arbitrary code with the privileges of the user running the application.

Microsoft Word Record Parsing Remote Stack Buffer Overflow Vulnerability

A working commercial exploit is available through VUPEN Security - Exploit and PoCs Service. This exploit is not otherwise publicly available or known to be circulating in the wild.

Microsoft Word Record Parsing Remote Stack Buffer Overflow Vulnerability

Solution:
The vendor has released updates and an advisory. Please see the references for details.


Microsoft Open XML File Format Converter for Mac 0

• Microsoft Open XML File Format Converter for Mac 1.1.3
  http://www.microsoft.com/downloads/details.aspx?FamilyID=4dd4bc05-1217 -497e-8f65-4347f2544ed6&displaylang=en

Microsoft Word 2003 SP3

• Microsoft Security Update for Microsoft Office Word 2003 (KB973443)
  http://www.microsoft.com/downloads/details.aspx?familyid=6b77bc62-bcbb -4b9a-97d1-a49ca0582e54&displaylang=en

Microsoft Office Word Viewer 0

• Microsoft Security Update for Microsoft Word Viewer 2003 (KB973866)
  http://www.microsoft.com/downloads/details.aspx?familyid=4cc5e6c5-7efb -4180-9a9b-0788115c91e1&displaylang=en

Microsoft Office 2008 for Mac 0

• Microsoft Microsoft Office 2008 for Mac 12.2.3 Update
  http://www.microsoft.com/downloads/details.aspx?FamilyID=b84fe57d-ddda -451e-9ead-69e10aee7928&displaylang=en

Microsoft Office 2004 for Mac 0

• Microsoft Microsoft Office 2004 for Mac 11.5.6 Update
  http://www.microsoft.com/downloads/details.aspx?FamilyID=8f115b1c-1e28 -4ecf-937c-99c4b60c7c8e&displaylang=en

Microsoft Word Record Parsing Remote Stack Buffer Overflow Vulnerability

References:

• Microsoft Word FIB Processing Stack Buffer Overflow Vulnerability (iDefense)
  
• Microsoft Word Homepage (Microsoft )
  
• iDefense Security Advisory 11.10.09: Microsoft Word FIB Processing Stack Buffer (iDefense Labs )
  
• Microsoft Security Bulletin MS09-068 (Microsoft)