CVE-2009-2506

Integer overflow in the text converters in Microsoft Office Word 2002 SP3 and 2003 SP3; Works 8.5; Office Converter Pack; and WordPad in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to execute arbitrary code via a DOC file with an invalid number of property names in the DocumentSummaryInformation stream, which triggers a heap-based buffer overflow.

CVSS v2.0 9.3 HIGH

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=834
http://support.avaya.com/css/P8/documents/100070184
http://www.securityfocus.com/bid/37216
http://www.us-cert.gov/cas/techalerts/TA09-342A.html	US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-073
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5846

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:microsoft:windows_2000::sp4::::::*
	cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
	cpe:2.3:o:microsoft:windows_xp::sp2::::::*
	cpe:2.3:o:microsoft:windows_xp::sp2:x64:::::
	cpe:2.3:o:microsoft:windows_xp::sp3::::::*

OR	cpe:2.3:a:microsoft:office_converter_pack::::::::
	cpe:2.3:a:microsoft:office_word:2002:sp3::::::
	cpe:2.3:a:microsoft:office_word:2003:sp3::::::
	cpe:2.3:a:microsoft:wordpad::::::::
	cpe:2.3:a:microsoft:works:8.5:::::::*

History

No history.

Information

Published : 2009-12-09 18:30

Updated : 2024-02-04 17:33

NVD link : CVE-2009-2506

Mitre link : CVE-2009-2506

CVE.ORG link : CVE-2009-2506

JSON object : View

Products Affected

microsoft

works
office_converter_pack
windows_xp
wordpad
windows_server_2003
windows_2000
office_word

CWE

CWE-189

Numeric Errors

{"id": "CVE-2009-2506", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2009-12-09T18:30:00.313", "references": [{"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=834", "source": "secure@microsoft.com"}, {"url": "http://support.avaya.com/css/P8/documents/100070184", "source": "secure@microsoft.com"}, {"url": "http://www.securityfocus.com/bid/37216", "source": "secure@microsoft.com"}, {"url": "http://www.us-cert.gov/cas/techalerts/TA09-342A.html", "tags": ["US Government Resource"], "source": "secure@microsoft.com"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-073", "source": "secure@microsoft.com"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5846", "source": "secure@microsoft.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-189"}]}], "descriptions": [{"lang": "en", "value": "Integer overflow in the text converters in Microsoft Office Word 2002 SP3 and 2003 SP3; Works 8.5; Office Converter Pack; and WordPad in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to execute arbitrary code via a DOC file with an invalid number of property names in the DocumentSummaryInformation stream, which triggers a heap-based buffer overflow."}, {"lang": "es", "value": "Desbordamiento de enteros en los convertidores de texto en Microsoft Office Word 2002 SP3 y 2003 SP3; Works versi\u00f3n 8.5; Office Converter Pack; y WordPad en Windows 2000 SP4, XP SP2 y SP3, y Server 2003 SP2 permite a los atacantes remotos ejecutar c\u00f3digo arbitrario por medio de un archivo DOC con un n\u00famero no v\u00e1lido de nombre de propiedad en la transmisi\u00f3n DocumentSummaryInformation, lo que desencadena un desbordamiento del b\u00fafer en la regi\u00f3n heap de la memoria."}], "lastModified": "2019-02-26T14:04:00.993", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "83E7C4A0-78CF-4B56-82BF-EC932BDD8ADF"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4D3B5E4F-56A6-4696-BBB4-19DF3613D020"}, {"criteria": "cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B339C33-8896-4896-88FF-88E74FDBC543"}, {"criteria": "cpe:2.3:o:microsoft:windows_xp:*:sp2:x64:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "57ECAAA8-8709-4AC7-9CE7-49A8040C04D3"}, {"criteria": "cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CE477A73-4EE4-41E9-8694-5A3D5DC88656"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:office_converter_pack:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1C6C8409-397E-40DF-A645-6409189D450D"}, {"criteria": "cpe:2.3:a:microsoft:office_word:2002:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0E99B12F-0DB7-4D0F-AD54-DD906CC8E3BD"}, {"criteria": "cpe:2.3:a:microsoft:office_word:2003:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CDA5243A-BA58-41BC-8FFC-317239E511C2"}, {"criteria": "cpe:2.3:a:microsoft:wordpad:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2531DDF2-D2AA-4919-B756-28478AEA5AA3"}, {"criteria": "cpe:2.3:a:microsoft:works:8.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "83EE0CCD-69AD-4705-9BB0-24688F7957F1"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "secure@microsoft.com"}