2009-3127 | Microsoft Office Spreadsheet code injection (BID-36908 / XFDB-54012)

CVSS Meta Temp Score Current Exploit Price (≈) CTI Interest Score
10.0 $0-$5k 0.08

A vulnerability classified as very critical has been found in Microsoft Office 2004/2008 (Office Suite Software). This affects some unknown functionality of the component Spreadsheet. The manipulation with an unknown input leads to a privilege escalation vulnerability. CWE is classifying the issue as CWE-94. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Microsoft Office Excel 2002 SP3 and 2003 SP3, Office 2004 and 2008 for Mac, Open XML File Format Converter for Mac, and Office Excel Viewer 2003 SP3 do not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka “Excel Cache Memory Corruption Vulnerability.”

The weakness was disclosed 11/11/2009 by Nicolas Joly with VUPEN Security (Website). It is possible to read the advisory at us-cert.gov. This vulnerability is uniquely identified as CVE-2009-3127 since 09/10/2009. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are unknown but an exploit is available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/27/2021).

It is declared as proof-of-concept. The exploit is shared for download at exploit-db.com. We expect the 0-day to have been worth approximately $5k-$25k. The vulnerability scanner Nessus provides a plugin with the ID 42441 (MS09-067: Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (972652)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Windows : Microsoft Bulletins. The commercial vulnerability scanner Qualys is able to test this issue with plugin 110096 (Microsoft Office Excel Remote Code Execution Vulnerabilities (MS09-067)).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product. Furthermore it is possible to detect and prevent this kind of attack with TippingPoint and the filter 9244.

The vulnerability is also documented in the databases at X-Force (54012), Vulnerability Center (SBV-23999), Tenable (42441) and Exploit-DB (14706). The entries 50794, 50793, 50792 and 50791 are pretty similar.




VulDB Meta Base Score: 10.0
VulDB Meta Temp Score: 10.0

VulDB Base Score: 10.0
VulDB Temp Score: 10.0
VulDB Vector: 🔍
VulDB Reliability: 🔍

🔍 🔍 🔍 🔍 🔍 🔍
🔍 🔍 🔍 🔍 🔍 🔍
🔍 🔍 🔍 🔍 🔍 🔍
Vector Complexity Authentication Confidentiality Integrity Availability
unlock unlock unlock unlock unlock unlock
unlock unlock unlock unlock unlock unlock
unlock unlock unlock unlock unlock unlock

VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍

NVD Base Score: 🔍

Class: Privilege escalation
ATT&CK: Unknown

Local: No
Remote: Yes

Availability: 🔍
Status: Proof-of-Concept
Download: 🔍

Price Prediction: 🔍
Current Price Estimation: 🔍

0-Day unlock unlock unlock unlock
Today unlock unlock unlock unlock

Nessus ID: 42441
Nessus Name: MS09-067: Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (972652)
Nessus File: 🔍
Nessus Risk: 🔍
Nessus Family: 🔍

OpenVAS ID: 900887
OpenVAS Name: Microsoft Office Excel Multiple Vulnerabilities (972652)
OpenVAS File: 🔍
OpenVAS Family: 🔍

Qualys ID: 🔍
Qualys Name: 🔍

Exploit-DB: 🔍

Threat Intelligenceinfoedit

Interest: 🔍
Active Actors: 🔍
Active APT Groups: 🔍Recommended: no mitigation known
Status: 🔍

0-Day Time: 🔍
TippingPoint: 🔍

McAfee IPS: 🔍
McAfee IPS Version: 🔍

PaloAlto IPS: 🔍
Fortigate IPS: 🔍

09/10/2009 🔍
11/10/2009 +61 days 🔍
11/10/2009 +0 days 🔍
11/10/2009 +0 days 🔍
11/11/2009 +1 days 🔍
11/11/2009 +0 days 🔍
11/11/2009 +0 days 🔍
03/18/2015 +1953 days 🔍
08/27/2021 +2354 days 🔍Vendor: https://www.microsoft.com/

Advisory: us-cert.gov
Researcher: Nicolas Joly
Organization: VUPEN Security
Status: Not defined

CVE: CVE-2009-3127 (🔍)

X-Force: 54012
Vulnerability Center: 23999 – [MS09-067] Microsoft Excel Cache Memory Corruption Vulnerability Allows Arbitrary Code Execution, Medium
SecurityFocus: 36908 – Microsoft Excel Formula Parsing Remote Code Execution Vulnerability

See also: 🔍

Created: 03/18/2015 15:15
Updated: 08/27/2021 16:18
Changes: (2) source_nessus_risk source_exploitdb
Complete: 🔍

Use the official API to access entries easily!

Source link