Type Vulnerability
Microsoft Office Excel contains a remote code execution vulnerability that could allow an attacker to take complete control of an affected system if a user opens a specially crafted Excel file that…
Microsoft · Code execution
Microsoft Office Remote Code Execution
CVE-2009-0238
What this means
This is rated high severity (8.8 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Microsoft Excel, Microsoft Excel Viewer and Microsoft Office, and 2 more are in your estate, and treat that as the priority.
Full vendor description
Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1; and Excel in Microsoft Office 2004 and 2008 for Mac allow remote attackers to execute arbitrary code via a crafted Excel document that triggers an access attempt on an invalid object, as exploited in the wild in February 2009 by Trojan.Mdropper.AC.
Scoring and exploitation
8.8/ 10
CVSS 3.1 base scoreHigh
Exploitable over the network without any account, but only if a user takes an action, such as opening a file or link. High impact on confidentiality, integrity and availability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitability
Longer bar: easier to attack
Attack vectorNetworkAV:N
Attack complexityLowAC:L
Privileges requiredNonePR:N
User interactionRequiredUI:R
ScopeUnchangedS:U
Impact
Longer bar: more harm
ConfidentialityHighC:H
IntegrityHighI:H
AvailabilityHighA:H
- Elevated attack likelihood (~42.9% in 30 days)Model estimate (): a probability signal, not confirmed exploitation
- Exploited in the wild
- Yes — confirmed exploitation (US CISA )
- Not reported
- Listed product
- Microsoft Office
Weaknesses
CWE-94
Affected products ()
- Microsoft Excel
- Microsoft Excel Viewer
- Microsoft Office
- Microsoft Office Compatibility Pack
- Microsoft Office Excel Viewer
Show the raw CPE strings (10)
- cpe:2.3:a:microsoft:excel:2000:sp3:*:*:*:*:*:*
- cpe:2.3:a:microsoft:excel:2002:sp3:*:*:*:*:*:*
- cpe:2.3:a:microsoft:excel:2003:sp3:*:*:*:*:*:*
- cpe:2.3:a:microsoft:excel:2007:sp1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:excel_viewer:*:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office:2004:*:*:*:*:macos:*:*
- cpe:2.3:a:microsoft:office:2008:*:*:*:*:macos:*:*
- cpe:2.3:a:microsoft:office_compatibility_pack:2007:sp1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office_excel_viewer:*:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office_excel_viewer:2003:sp3:*:*:*:*:*:*
References
20 links from the CVE record, grouped by site; the vendor's advisory comes first.
microsoft.com1 linkVendor advisory
- 968272.mspx (opens in a new tab)Vendor Advisory
docs.microsoft.com1 linkVendor advisory
- ms09-009 (opens in a new tab)Vendor Advisory
blogs.zdnet.com1 link
- security (opens in a new tab)Broken Link
isc.sans.org1 link
- diary.html (opens in a new tab)Press/Media Coverage
securitytracker.com1 link
- id (opens in a new tab)Broken Link
securityfocus.com1 link
- 33870 (opens in a new tab)Broken Link
symantec.com1 link
- writeup.jsp (opens in a new tab)Broken Link
us-cert.gov1 link
- TA09-104A.html (opens in a new tab)US Government Resource
vupen.com1 link
- 1023 (opens in a new tab)Broken Link
exchange.xforce.ibmcloud.com1 link
- 48875 (opens in a new tab)Third Party Advisory
oval.cisecurity.org1 link