Microsoft Visio Bugs Let Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1021702 |
|
SecurityTracker URL: http://securitytracker.com/id/1021702
|
|
CVE Reference:
CVE-2009-0095, CVE-2009-0096, CVE-2009-0097
(Links to External Site)
|
Date: Feb 10 2009
|
Impact:
Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 2002 SP2, 2003 SP3, 2007 SP1
|
Description:
Several vulnerabilities were reported in Microsoft Visio. A remote user can cause arbitrary code to be executed on the target user's system.
A remote user can create a specially crafted Visio file that, when loaded by the target user, will execute arbitrary code on the target system. The code will run with the privileges of the target user.
Specially crafted object data can trigger a validation flaw and cause code execution [CVE-2009-0095].
Specially crafted object data can trigger a memory corruption flaw and cause code execution [CVE-2009-0096].
Specially crafted files can trigger a memory allocation error and cause code execution [CVE-2009-0097].
Microsoft Office Visio Viewer versions 2002, 2003, 2007, and 2007 SP1 are not affected.
Bing Liu of Fortinet's FortiGuard Global Security Research Team reported these vulnerabilities.
|
Impact:
A remote user can create a file that, when loaded by the target user, will execute arbitrary code on the target user's system.
|
Solution:
The vendor has issued the following fixes:
Microsoft Office Visio 2002 Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?familyid=a30cef3f-9eaf-45bd-9a25-4b65302362cb
Microsoft Office Visio 2003 Service Pack 3:
http://www.microsoft.com/downloads/details.aspx?familyid=c9cb589e-1a37-485d-8402-7f42bcd7a1a9
Microsoft Office Visio 2007 Service Pack 1:
http://www.microsoft.com/downloads/details.aspx?familyid=4b711e89-8de2-4f17-8afc-691e0604ff82
A restart may be required.
The Microsoft advisory is available at:
http://www.microsoft.com/technet/security/bulletin/ms09-005.mspx
|
Vendor URL: www.microsoft.com/technet/security/bulletin/ms09-005.mspx (Links to External Site)
|
Cause:
Access control error
|
Underlying OS:
Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 10 Feb 2009 14:48:14 -0500
Subject: http://www.microsoft.com/technet/security/bulletin/ms09-005.mspx
|
Microsoft Security Bulletin MS09-005 - Important: Vulnerabilities in Microsoft Office Visio Could Allow Remote Code Execution (957634)
CVE-2009-0095
CVE-2009-0096
CVE-2009-0097
|
|
