Microsoft Project Invalid Resource Memory Allocation Remote Code Execution Vulnerability
BID:37211
Info
Microsoft Project Invalid Resource Memory Allocation Remote Code Execution Vulnerability
| Bugtraq ID: | 37211 |
| Class: | Design Error |
| CVE: |
CVE-2009-0102 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 08 2009 12:00AM |
| Updated: | Dec 09 2009 08:34PM |
| Credit: | Bing Liu of Fortinet's FortiGuard Labs |
| Vulnerable: |
Microsoft Project 2003 SP3 Microsoft Project 2003 SP2 Microsoft Project 2003 SP1 Microsoft Project 2003 Microsoft Project 2002 SP1 Microsoft Project 2002 0 Microsoft Project 2000 SR1 Microsoft Project 2000 |
| Not Vulnerable: | |
Discussion
Microsoft Project Invalid Resource Memory Allocation Remote Code Execution Vulnerability
Microsoft Project is prone to a remote code-execution vulnerability.
An attacker can exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions.
Microsoft Project is prone to a remote code-execution vulnerability.
An attacker can exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions.
Exploit / POC
Microsoft Project Invalid Resource Memory Allocation Remote Code Execution Vulnerability
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Microsoft Project Invalid Resource Memory Allocation Remote Code Execution Vulnerability
Solution:
The vendor has released an advisory and updates. Please see the references for details.
Microsoft Project 2000 SR1
Microsoft Project 2002 SP1
Microsoft Project 2003 SP3
Solution:
The vendor has released an advisory and updates. Please see the references for details.
Microsoft Project 2000 SR1
-
Microsoft Security Update for Microsoft Project 2000 (KB961083)
http://www.microsoft.com/downloads/details.aspx?familyid=135c010a-55f4 -4385-b67d-96ea06ef881a
Microsoft Project 2002 SP1
-
Microsoft Security Update for Microsoft Project 2002 (KB961079)
http://www.microsoft.com/downloads/details.aspx?familyid=c55ef8fe-8f66 -42fc-a298-de6f8886b3e4
Microsoft Project 2003 SP3
-
Microsoft Security Update for Microsoft Office Project 2003 (KB961082)
http://www.microsoft.com/downloads/details.aspx?familyid=2ea8ca39-f130 -439a-92d5-77e9ef050105
References
Microsoft Project Invalid Resource Memory Allocation Remote Code Execution Vulnerability
References:
References:
- Fortinet Discovers Microsoft Office Project Vulnerability (MS09-074) (FortiGuard)
- Microsoft Project Homepage (Microsoft)
- Microsoft Security Bulletin MS09-074 (Microsoft)