CVE-2009-0557
published 2009-06-10CVE-2009-0557: Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and SP2; Open…
PriorityP179high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2022-06-22
Exploited in the wild
EPSS
58.55%
99.0th percentile
Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and SP2; Open XML File Format Converter for Mac; Microsoft Office Excel Viewer 2003 SP3; Microsoft Office Excel Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allow remote attackers to execute arbitrary code via a crafted Excel file with a malformed record object, aka "Object Record Corruption Vulnerability."
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | office | — | — |
| microsoft | office | — | — |
| microsoft | office | — | — |
| microsoft | office | — | — |
| microsoft | office | — | — |
| microsoft | office | — | — |
| microsoft | office_compatibility_pack | — | — |
| microsoft | office_excel_viewer | — | — |
| microsoft | office_sharepoint_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Trigger vector is a crafted Excel file containing a malformed record object; inspect Excel files for anomalous or malformed record objects as the exploit delivery mechanism. ↗
- →File-based delivery via Excel documents should be treated as the primary attack surface; any Excel file from an untrusted source should be treated with suspicion, particularly those exploiting record parsing in legacy formats. ↗
- ·Vulnerability affects a wide range of Microsoft Office versions including Office 2000 SP3, Office XP SP3, Office 2003 SP3, Office 2004 and 2008 for Mac, 2007 Microsoft Office System SP1 and SP2, Open XML File Format Converter for Mac, Excel Viewer 2003 SP3, Excel Viewer, and Compatibility Pack SP1 and SP2 — detection/patching scope must cover all these variants. ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vulncheck7.8HIGH
cisa7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Microsoft Office Object Record Corruption Vulnerability
cisa·2022-06-08·CVSS 7.8
CVE-2009-0557 [HIGH] CWE-94 Microsoft Office Object Record Corruption Vulnerability
Vulnerability: Microsoft Office Object Record Corruption Vulnerability
Affected: Microsoft Office
Microsoft Office contains an object record corruption vulnerability that allows remote attackers to execute code via a crafted Excel file with a malformed record object.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2009-0557
Remediation Due Date: 2022-06-22
GHSA
GHSA-fmc6-x6ww-78h8: Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and SP
ghsa_unreviewed·2022-05-02
CVE-2009-0557 [HIGH] CWE-94 GHSA-fmc6-x6ww-78h8: Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and SP
Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and SP2; Open XML File Format Converter for Mac; Microsoft Office Excel Viewer 2003 SP3; Microsoft Office Excel Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allow remote attackers to execute arbitrary code via a crafted Excel file with a malformed record object, aka "Object Record Corruption Vulnerability."
VulnCheck
Microsoft Office Object Record Corruption Vulnerability
vulncheck·2009·CVSS 7.8
CVE-2009-0557 [HIGH] CWE-94 Microsoft Office Object Record Corruption Vulnerability
Microsoft Office Object Record Corruption Vulnerability
Microsoft Office contains an object record corruption vulnerability that allows remote attackers to execute code via a crafted Excel file with a malformed record object.
Affected: Microsoft Office
Required Action: Apply updates per vendor instructions.
Exploitation References: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Remediation Due: 2022-06-22
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://osvdb.org/54953http://www.securityfocus.com/bid/35241http://www.securitytracker.com/id?1022351http://www.us-cert.gov/cas/techalerts/TA09-160A.htmlhttp://www.vupen.com/english/advisories/2009/1540https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-021https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5564http://osvdb.org/54953http://www.securityfocus.com/bid/35241http://www.securitytracker.com/id?1022351http://www.us-cert.gov/cas/techalerts/TA09-160A.htmlhttp://www.vupen.com/english/advisories/2009/1540https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-021https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5564https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-0557
2009-06-10
Published
2022-06-08
Added to CISA KEV
Exploited in the wild