CVE-2009-1534
published 2009-08-12CVE-2009-1534: Buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2000 Web Components SP3, Office XP Web Components SP3, BizTalk…
PriorityP266critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
51.61%
98.8th percentile
Buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2000 Web Components SP3, Office XP Web Components SP3, BizTalk Server 2002, and Visual Studio .NET 2003 SP1 allows remote attackers to execute arbitrary code via crafted property values, aka "Office Web Components Buffer Overflow Vulnerability."
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | isa_server | — | — |
| microsoft | isa_server | — | — |
| microsoft | office | — | — |
| microsoft | office | — | — |
| microsoft | office_web_components | — | — |
| microsoft | office_web_components | — | — |
| microsoft | office_web_components | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect exploitation attempts by monitoring for instantiation of OWC ActiveX CLSIDs 0002E510-0000-0000-C000-000000000046 or 0002E511-0000-0000-C000-000000000046 in browser processes, particularly with an overly long HTMLURL parameter value. ↗
- →Monitor HTTP responses for HTML pages embedding OWC Spreadsheet ActiveX objects (ProgId OWC.Spreadsheet.9) combined with large JavaScript string generation, which is characteristic of heap-spray exploitation of this vulnerability. ↗
- →Look for HTTP responses with a static 'Last-Modified' header value of 'Tue, 11 Aug 2009 07:13:49 GMT', which is hardcoded in the Metasploit exploit module and required by the vulnerability trigger. ↗
- →Flag process migration activity (migrate -f) immediately following browser-based code execution, as the Metasploit module sets 'InitialAutoRunScript' to 'migrate -f' as a default post-exploitation step. ↗
- →Detect use of the SEH overwrite return address 0x32521239 (pop/pop/ret gadget in msohev.dll 10.0.2609.0) in memory or crash dumps as an indicator of exploitation of this specific target configuration. ↗
- ·The exploit payload space is limited to 1024 bytes and null bytes (0x00) and 0xF0 are bad characters that must be avoided in shellcode. ↗
- ·The SEH offset for the Office XP SP3 target is (4096*7)+1076 = 29772 bytes; the SP0 target uses offset 31337 with a placeholder return address (0x42424242), indicating that target is not fully functional. ↗
- ·The default target is index 1 (Windows XP SP3 - IE6 - Office XP SP3); target index 0 (Office XP SP0) has a dummy return address and is not operational. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Microsoft OWC Spreadsheet - HTMLURL Buffer Overflow (MS09-043) (Metasploit)
exploitdb·2010-04-30
CVE-2009-1534 Microsoft OWC Spreadsheet - HTMLURL Buffer Overflow (MS09-043) (Metasploit)
Microsoft OWC Spreadsheet - HTMLURL Buffer Overflow (MS09-043) (Metasploit)
---
##
# $Id: ms09_043_owc_htmlurl.rb 9179 2010-04-30 08:40:19Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Microsoft OWC Spreadsheet HTMLURL Buffer Overflow',
'Description' => %q{
This module exploits a buffer overflow in Microsoft's Office Web Components.
When passing an overly long string as the "HTMLURL" parameter an attacker can
execute arbitrary code.
},
'License' => MSF_LICENSE,
'Author' => [ 'jduck' ],
'Version' => '$Revision: 9179 $',
'Reference
Metasploit
Microsoft OWC Spreadsheet HTMLURL Buffer Overflow
metasploit
Microsoft OWC Spreadsheet HTMLURL Buffer Overflow
Microsoft OWC Spreadsheet HTMLURL Buffer Overflow
This module exploits a buffer overflow in Microsoft's Office Web Components. When passing an overly long string as the "HTMLURL" parameter an attacker can execute arbitrary code.
No writeups or analysis indexed.
http://osvdb.org/56916http://www.securityfocus.com/bid/35992http://www.securitytracker.com/id?1022708http://www.us-cert.gov/cas/techalerts/TA09-223A.htmlhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-043https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6326http://osvdb.org/56916http://www.securityfocus.com/bid/35992http://www.securitytracker.com/id?1022708http://www.us-cert.gov/cas/techalerts/TA09-223A.htmlhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-043https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6326
2009-08-12
Published