CVE-2009-3129
published 2009-11-11CVE-2009-3129: Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003…
PriorityP185high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2022-03-24
Exploited in the wild
EPSS
85.73%
99.7th percentile
Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset, aka "Excel Featheader Record Memory Corruption Vulnerability."
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | excel | — | — |
| microsoft | excel | — | — |
| microsoft | excel | — | — |
| microsoft | excel_viewer | — | — |
| microsoft | office | — | — |
| microsoft | office | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
04 00 00 00 ee ff c0 da
bytes↗
\x67\x08 (FEATHEADER record tag 0x0867) followed by 10 null bytes, isf=0x0004, cbHdrData=0x00000004
- →Detect malicious XLS files containing a FEATHEADER (record tag 0x0867) with an anomalous cbHdrData value of 0x00000004 and isf value of 0x0004, which is the exploit trigger condition for CVE-2009-3129. ↗
- →Scan OLE Compound Document (XLS) files for the byte sequence '04 00 00 00 ee ff c0 da' within the Workbook stream, which is a known debug/crash marker used during exploit development targeting this vulnerability. ↗
- →The exploit writes a crafted Workbook stream into an OLE Compound Document with a stream named 'Workbook'; inspect XLS files where the Workbook stream contains record tag 0x0867 (FEATHEADER) with attacker-controlled pointer values immediately following cbHdrData. ↗
- →The Metasploit module sets EXITFUNC to 'process', which is a common shellcode exit strategy; correlate with process-level anomalies in Excel (excel.exe) spawning child processes after opening an XLS file. ↗
- ·The exploit requires the user to open a malicious XLS file; on some Office versions a warning dialog must be dismissed before the payload executes, reducing silent exploitation success. ↗
- ·The payload space is limited to 1024 bytes with null bytes as bad characters; shellcode must avoid null bytes and fit within this constraint. ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vulncheck7.8HIGH
cisa7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-8325-hmcc-g9mq: Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Vi
ghsa_unreviewed·2022-05-02
CVE-2009-3129 [HIGH] CWE-787 GHSA-8325-hmcc-g9mq: Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Vi
Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset, aka "Excel Featheader Record Memory Corruption Vulnerability."
VulnCheck
Microsoft Excel Featheader Record Memory Corruption Vulnerability
vulncheck·2009·CVSS 7.8
CVE-2009-3129 [HIGH] CWE-94 Microsoft Excel Featheader Record Memory Corruption Vulnerability
Microsoft Excel Featheader Record Memory Corruption Vulnerability
Microsoft Office Excel allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset.
Affected: Microsoft Excel
Required Action: Apply updates per vendor instructions.
Exploitation References: https://web.archive.org/web/20120907091804/http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_the_taidoor_campaign.pdf; https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp_ixeshe.pdf; https://securelist.com/red-october-diplomatic-cyber-attacks-investigation/36740/; https://securelist.com/the-epic-turla-operation/65545/; https://unit42.paloaltonetworks.com/scar
CISA
Microsoft Excel Featheader Record Memory Corruption Vulnerability
cisa·2022-03-03·CVSS 7.8
CVE-2009-3129 [HIGH] CWE-94 Microsoft Excel Featheader Record Memory Corruption Vulnerability
Vulnerability: Microsoft Excel Featheader Record Memory Corruption Vulnerability
Affected: Microsoft Excel
Microsoft Office Excel allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2009-3129
Remediation Due Date: 2022-03-24
No detection rules found.
Exploit-DB
Microsoft Excel - Malformed FEATHEADER Record (MS09-067) (Metasploit)
exploitdb·2010-09-25
CVE-2009-3129 Microsoft Excel - Malformed FEATHEADER Record (MS09-067) (Metasploit)
Microsoft Excel - Malformed FEATHEADER Record (MS09-067) (Metasploit)
---
##
# $Id: ms09_067_excel_featheader.rb 10477 2010-09-25 11:59:02Z mc $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
require 'rex/ole'
class Metasploit3 'Microsoft Excel Malformed FEATHEADER Record Vulnerability',
'Description' => %q{
This module exploits a vulnerability in the handling of the FEATHEADER record
by Microsoft Excel. Revisions of Office XP and later prior to the release of the
MS09-067 bulletin are vulnerable.
When processing a FEATHEADER (Shared Feature) record, Micros
Exploit-DB
Microsoft Excel - FEATHEADER Record (MS09-067)
exploitdb·2010-08-21·CVSS 7.8
CVE-2009-3129 [HIGH] Microsoft Excel - FEATHEADER Record (MS09-067)
Microsoft Excel - FEATHEADER Record (MS09-067)
---
#MS Excel Malformed FEATHEADER Record Exploit
#CVE-2009-3129, MS09-067, OSVDB-59860
#Vulnerble application MS office 2003/2007
#Tested on XP SP2 - MS Ofice 2003 v. 11.5604.5606
#Sean Larsson - Original Discovery
#!/usr/bin/python
import sys
import zlib
#Allwin WinExec cmd.exe + ExitProcess Shellcode - 195 bytes by RubberDuck =)
shellcode = (
b"\xFC\x33\xD2\xB2\x30\x64\xFF\x32\x5A\x8B"
b"\x52\x0C\x8B\x52\x14\x8B\x72\x28\x33\xC9"
b"\xB1\x18\x33\xFF\x33\xC0\xAC\x3C\x61\x7C"
b"\x02\x2C\x20\xC1\xCF\x0D\x03\xF8\xE2\xF0"
b"\x81\xFF\x5B\xBC\x4A\x6A\x8B\x5A\x10\x8B"
b"\x12\x75\xDA\x8B\x53\x3C\x03\xD3\xFF\x72"
b"\x34\x8B\x52\x78\x03\xD3\x8B\x72\x20\x03"
b"\xF3\x33\xC9\x41\xAD\x03\xC3\x81\x38\x47"
b"\x65\x74\x50\x75\xF4\x81\x78\x04\x72\x6F"
b"\x
Metasploit
MS09-067 Microsoft Excel Malformed FEATHEADER Record Vulnerability
metasploit
MS09-067 Microsoft Excel Malformed FEATHEADER Record Vulnerability
MS09-067 Microsoft Excel Malformed FEATHEADER Record Vulnerability
This module exploits a vulnerability in the handling of the FEATHEADER record by Microsoft Excel. Revisions of Office XP and later prior to the release of the MS09-067 bulletin are vulnerable. When processing a FEATHEADER (Shared Feature) record, Microsoft used a data structure from the file to calculate a pointer offset without doing proper validation. Attacker supplied data is then used to calculate the location of an object, and in turn a virtual function call. This results in arbitrary code execution. NOTE: On some versions of Office, the user will need to dismiss a warning dialog prior to the payload executing.
arXiv
Investigation of Advanced Persistent Threats Network-based Tactics, Techniques and Procedures
arxiv_fulltext·2025-02-12
Investigation of Advanced Persistent Threats Network-based Tactics, Techniques and Procedures
Investigation of Advanced Persistent Threats Network-based Tactics, Techniques and Procedures
Almuthanna Alageel
and
Sergio Maffeis
Department of Computing
Imperial College London
London, United Kingdom
plain
plain
## Abstract
The scarcity of data and the high complexity of Advanced Persistent Threats (APTs) attacks have created challenges in comprehending their behavior and hindered the exploration of effective detection techniques.
To create an effective APT detection strategy, it is important to examine the Tactics, Techniques, and Procedures (TTPs) that have been reported by the industry. These TTPs can be difficult to classify as either malicious or legitimate. When developing an approach for the next generation of network intrusion detection systems (NIDS), it is necessary to
Unit42
Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists
blogs_unit42·2016-01-24
Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists
Threat Research Center
Threat Research
Malware
## Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists
Robert Falcone
Jen Miller-Osborn
Published: January 24, 2016
Malware
Threat Research
Android
Apple
BrutishCommand
CallMe
Cyber espionage
Cyber Threat Alliance
Cybersecurity
Espionage
FakeM
Mac OS X
Microsoft
MobileOrder
Psylo
Scarlet Mimic
SkiBoot Loader
SubtractThis
Trojans
## Executive Summary
Over the past seven months, Unit 42 has been investigating a series of attacks we attribute to a group we have code named “Scarlet Mimic.” The attacks began over four years ago and their targeting pattern suggests that this adversary’s primary mission is to gather information about minority rights activists. We do not have evidence directly linking
Unit42
Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists
blogs_unit42·2016-01-24
Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists
## Executive Summary
Over the past seven months, Unit 42 has been investigating a series of attacks we attribute to a group we have code named “Scarlet Mimic.” The attacks began over four years ago and their targeting pattern suggests that this adversary’s primary mission is to gather information about minority rights activists. We do not have evidence directly linking these attacks to a government source, but the information derived from these activities supports an assessment that a group or groups with motivations similar to the stated position of the Chinese government in relation to these targets is involved.
The goal of this report is to expose the tools, tactics and infrastructure deployed by Scarlet Mimic in order to increase awareness of this threat and decrease its operational
Qualys
US-CERT: Top 30 Vulnerabilities | Qualys
blogs_qualys·2015-05-01·CVSS 2.6
[LOW] US-CERT: Top 30 Vulnerabilities | Qualys
On April 29, 2015 US-CERT published TA15-119A which describes the Top 30 vulnerabilities that critical infrastructure organizations should focus on because they are under attack all the time. The list contains Windows, Internet Explorer, Adobe Software from Reader, Flash to Cold Fusion, Java from Oracle and others and is quite similar to the more generic set of software packages published by the German BSI last December.
Here is a list of the vulnerabilities in the advisory. I have reordered and optimized where possible for efficient scanning with Qualys, for example listing the most recent patch first to take advantage of superseding patches:
- Windows: MS14-060 for CVE-2014-4114, Qualys ID: 90979
- Internet Explorer: MS14-021 for CVE-2014-1776, Qualys ID: 100191
- MS14-012 for CVE-201
Qualys
US-CERT: Top 30 Vulnerabilities | Qualys
blogs_qualys·2015-05-01·CVSS 2.6
[LOW] US-CERT: Top 30 Vulnerabilities | Qualys
On April 29, 2015 US-CERT published TA15-119A which describes the Top 30 vulnerabilities that critical infrastructure organizations should focus on because they are under attack all the time. The list contains Windows, Internet Explorer, Adobe Software from Reader, Flash to Cold Fusion, Java from Oracle and others and is quite similar to the more generic set of software packages published by the German BSI last December.
Here is a list of the vulnerabilities in the advisory. I have reordered and optimized where possible for efficient scanning with Qualys, for example listing the most recent patch first to take advantage of superseding patches:
Windows: MS14-060 for CVE-2014-4114, Qualys ID: 90979
MS14-012 for CVE-2014-0322
MS13-038 for CVE-2013-1347
MS13-008 for CVE-2012-4792
MS10-01
Threat Intel
APT12 (APT12, IXESHE, DynCalc)
threat_intel·CVSS 8.8
[HIGH] APT12 (APT12, IXESHE, DynCalc)
# Threat Actor Profile: APT12
ATT&CK ID: G0005
Also known as: APT12, IXESHE, DynCalc, Numbered Panda, DNSCALC
Suspected origin: China
## Overview
APT12 is a threat group that has been attributed to China. The group has targeted a variety of victims including but not limited to media outlets, high-tech companies, and multiple governments.(Citation: Meyers Numbered Panda)
## Techniques (TTPs)
### Initial Access
- T1566.001 Spearphishing Attachment
Usage: APT12 has sent emails with malicious Microsoft Office documents and PDFs attached.(Citation: Moran 2014)(Citation: Trend Micro IXESHE 2012)
### Execution
- T1204.002 Malicious File
Usage: APT12 has attempted to get victims to open malicious Microsoft Word and PDF attachment sent via spearphishing.(Citation: Moran 2014)(Citation: Trend Mi
http://archives.neohapsis.com/archives/bugtraq/2009-11/0080.htmlhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=832http://osvdb.org/59860http://www.exploit-db.com/exploits/14706http://www.securityfocus.com/bid/36945http://www.securitytracker.com/id?1023157http://www.us-cert.gov/cas/techalerts/TA09-314A.htmlhttp://www.zerodayinitiative.com/advisories/ZDI-09-083https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-067https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6521http://archives.neohapsis.com/archives/bugtraq/2009-11/0080.htmlhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=832http://osvdb.org/59860http://www.exploit-db.com/exploits/14706http://www.securityfocus.com/bid/36945http://www.securitytracker.com/id?1023157http://www.us-cert.gov/cas/techalerts/TA09-314A.htmlhttp://www.zerodayinitiative.com/advisories/ZDI-09-083https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-067https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6521https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3129
2009-11-11
Published
2022-03-03
Added to CISA KEV
Exploited in the wild