CVE-2009-1136

CVSS V2 High 9.3 CVSS V3 None
Description
The Microsoft Office Web Components Spreadsheet ActiveX control (aka OWC10 or OWC11), as distributed in Office XP SP3 and Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, Office 2003 Web Components SP1 for the 2007 Microsoft Office System, Internet Security and Acceleration (ISA) Server 2004 SP3 and 2006 Gold and SP1, and Office Small Business Accounting 2006, when used in Internet Explorer, allows remote attackers to execute arbitrary code via a crafted call to the msDataSourceObject method, as exploited in the wild in July and August 2009, aka "Office Web Components HTML Script Vulnerability."
Overview
  • CVE ID
  • CVE-2009-1136
  • Assigner
  • secure@microsoft.com
  • Vulnerability Status
  • Modified
  • Published Version
  • 2009-07-15T15:30:01
  • Last Modified Date
  • 2018-10-12T21:51:03
Weakness Enumerations
CWE URL
CWE-94 http://cwe.mitre.org/data/definitions/94.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:microsoft:isa_server:2004:sp3:enterprise:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:isa_server:2004:sp3:standard:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:isa_server:2006:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:isa_server:2006:sp1:*:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:isa_server:2006:supportability:*:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:office:2003:*:small_business_accounting_2006:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:office_web_components:2003:sp1:2007_microsoft_office:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:office_web_components:2003:sp3:*:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:office_web_components:xp:sp3:*:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:office_xp:sp3:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:M/Au:N/C:C/I:C/A:C
  • Access Vector
  • NETWORK
  • Access Compatibility
  • MEDIUM
  • Authentication
  • NONE
  • Confidentiality Impact
  • COMPLETE
  • Integrity Impact
  • COMPLETE
  • Availability Impact
  • COMPLETE
  • Base Score
  • 9.3
  • Severity
  • HIGH
  • Exploitability Score
  • 8.6
  • Impact Score
  • 10
References
Reference URL Reference Tags
http://isc.sans.org/diary.html?storyid=6778
http://trac.metasploit.com/browser/framework3/trunk/modules/exploits/windows/browser/owc_spreadsheet_msdso.rb Exploit
http://blogs.technet.com/msrc/archive/2009/07/13/microsoft-security-advisory-973472-released.aspx
http://xeye.us/blog/2009/07/one-0day/ Exploit
http://www.microsoft.com/technet/security/advisory/973472.mspx Vendor Advisory
http://blogs.technet.com/srd/archive/2009/07/13/more-information-about-the-office-web-components-activex-vulnerability.aspx
http://www.us-cert.gov/cas/techalerts/TA09-223A.html US Government Resource
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5809
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-043
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2009-1136
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1136
History
Created Old Value New Value Data Type Notes
2022-05-10 18:24:49 Added to TrackCVE