CVE-2009-1136
published 2009-07-15CVE-2009-1136: The Microsoft Office Web Components Spreadsheet ActiveX control (aka OWC10 or OWC11), as distributed in Office XP SP3 and Office 2003 SP3, Office XP Web…
PriorityP278critical9.3CVSS 2.0
AVNACMAuNCCICAC
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
62.02%
99.1th percentile
The Microsoft Office Web Components Spreadsheet ActiveX control (aka OWC10 or OWC11), as distributed in Office XP SP3 and Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, Office 2003 Web Components SP1 for the 2007 Microsoft Office System, Internet Security and Acceleration (ISA) Server 2004 SP3 and 2006 Gold and SP1, and Office Small Business Accounting 2006, when used in Internet Explorer, allows remote attackers to execute arbitrary code via a crafted call to the msDataSourceObject method, as exploited in the wild in July and August 2009, aka "Office Web Components HTML Script Vulnerability."
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | isa_server | — | — |
| microsoft | isa_server | — | — |
| microsoft | office | — | — |
| microsoft | office_web_components | — | — |
| microsoft | office_web_components | — | — |
| microsoft | office_xp | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
%u0b0c%u0b0C
- →Detect heap-spray pattern using the 0x0b0c0b0c / 0x0C0C0C0C return address constants in JavaScript, characteristic of OWC msDataSourceObject exploits in the wild. ↗
- →Monitor Internet Explorer for ActiveX instantiation of OWC10 (owc10.dll) or OWC11 (owc11.dll) followed by a call to the msDataSourceObject method from untrusted web content. ↗
- →Look for JavaScript heap-spray patterns using unescape() with large block allocations sized around 0x81000 minus shellcode length, consistent with the exploit's memory layout. ↗
- ·The exploit targets only Windows XP SP0–SP3 with IE 6.0 SP0-2 and IE 7.0; the hardcoded return address (0x0C0C0C0C) is platform-specific and will not apply to other OS/browser combinations. ↗
- ·Affected products span multiple Office and ISA Server versions; detection/blocking scope must cover OWC10 and OWC11 ActiveX controls across all listed distributions. ↗
- ·The Metasploit module notes the exploit payload space is limited to 1024 bytes with no bad characters defined; custom in-the-wild variants may differ in shellcode size and encoding. ↗
CVSS provenance
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vulncheck9.3CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-3vw3-8gqg-phx5: The Microsoft Office Web Components Spreadsheet ActiveX control (aka OWC10 or OWC11), as distributed in Office XP SP3 and Office 2003 SP3, Office XP W
ghsa_unreviewed·2022-05-02
CVE-2009-1136 [HIGH] CWE-94 GHSA-3vw3-8gqg-phx5: The Microsoft Office Web Components Spreadsheet ActiveX control (aka OWC10 or OWC11), as distributed in Office XP SP3 and Office 2003 SP3, Office XP W
The Microsoft Office Web Components Spreadsheet ActiveX control (aka OWC10 or OWC11), as distributed in Office XP SP3 and Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, Office 2003 Web Components SP1 for the 2007 Microsoft Office System, Internet Security and Acceleration (ISA) Server 2004 SP3 and 2006 Gold and SP1, and Office Small Business Accounting 2006, when used in Internet Explorer, allows remote attackers to execute arbitrary code via a crafted call to the msDataSourceObject method, as exploited in the wild in July and August 2009, aka "Office Web Components HTML Script Vulnerability."
VulnCheck
Microsoft isa_server Improper Control of Generation of Code ('Code Injection')
vulncheck·2009·CVSS 9.3
CVE-2009-1136 [CRITICAL] Microsoft isa_server Improper Control of Generation of Code ('Code Injection')
Microsoft isa_server Improper Control of Generation of Code ('Code Injection')
The Microsoft Office Web Components Spreadsheet ActiveX control (aka OWC10 or OWC11), as distributed in Office XP SP3 and Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, Office 2003 Web Components SP1 for the 2007 Microsoft Office System, Internet Security and Acceleration (ISA) Server 2004 SP3 and 2006 Gold and SP1, and Office Small Business Accounting 2006, when used in Internet Explorer, allows remote attackers to execute arbitrary code via a crafted call to the msDataSourceObject method, as exploited in the wild in July and August 2009, aka "Office Web Components HTML Script Vulnerability."
Affected: Microsoft isa_server
Required Action: Apply remediations or mitigations per
No detection rules found.
Exploit-DB
Microsoft Office Web Components (OWC) Spreadsheet - msDataSourceObject Memory Corruption (MS09-043) (Metasploit)
exploitdb·2010-07-20
CVE-2009-1136 Microsoft Office Web Components (OWC) Spreadsheet - msDataSourceObject Memory Corruption (MS09-043) (Metasploit)
Microsoft Office Web Components (OWC) Spreadsheet - msDataSourceObject Memory Corruption (MS09-043) (Metasploit)
---
##
# $Id: ms09_043_owc_msdso.rb 9893 2010-07-20 23:28:47Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Microsoft OWC Spreadsheet msDataSourceObject Memory Corruption',
'Description' => %q{
This module exploits a memory corruption vulnerability within versions 10 and 11 of
the Office Web Component Spreadsheet ActiveX control. This module was based on
an exploit found in the wild.
},
'License' => MSF_LICENSE,
'Autho
Exploit-DB
Microsoft Office Web Components (OWC) Spreadsheet - ActiveX Buffer Overflow (PoC)
exploitdb·2009-07-16
CVE-2009-1136 Microsoft Office Web Components (OWC) Spreadsheet - ActiveX Buffer Overflow (PoC)
Microsoft Office Web Components (OWC) Spreadsheet - ActiveX Buffer Overflow (PoC)
---
var shellcode = unescape("evil code");
var array = new Array();
var ls = 0x81000-(shellcode.length*2);
var bigblock = unescape("%u0b0c%u0b0C");
while(bigblock.length
# milw0rm.com [2009-07-16]
Metasploit
Microsoft OWC Spreadsheet msDataSourceObject Memory Corruption
metasploit
Microsoft OWC Spreadsheet msDataSourceObject Memory Corruption
Microsoft OWC Spreadsheet msDataSourceObject Memory Corruption
This module exploits a memory corruption vulnerability within versions 10 and 11 of the Office Web Component Spreadsheet ActiveX control. This module was based on an exploit found in the wild.
http://blogs.technet.com/msrc/archive/2009/07/13/microsoft-security-advisory-973472-released.aspxhttp://blogs.technet.com/srd/archive/2009/07/13/more-information-about-the-office-web-components-activex-vulnerability.aspxhttp://isc.sans.org/diary.html?storyid=6778http://trac.metasploit.com/browser/framework3/trunk/modules/exploits/windows/browser/owc_spreadsheet_msdso.rbhttp://www.microsoft.com/technet/security/advisory/973472.mspxhttp://www.us-cert.gov/cas/techalerts/TA09-223A.htmlhttp://xeye.us/blog/2009/07/one-0day/https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-043https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5809http://blogs.technet.com/msrc/archive/2009/07/13/microsoft-security-advisory-973472-released.aspxhttp://blogs.technet.com/srd/archive/2009/07/13/more-information-about-the-office-web-components-activex-vulnerability.aspxhttp://isc.sans.org/diary.html?storyid=6778http://trac.metasploit.com/browser/framework3/trunk/modules/exploits/windows/browser/owc_spreadsheet_msdso.rbhttp://www.microsoft.com/technet/security/advisory/973472.mspxhttp://www.us-cert.gov/cas/techalerts/TA09-223A.htmlhttp://xeye.us/blog/2009/07/one-0day/https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-043https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5809
2009-07-15
Published
Exploited in the wild