Endpoint Protection

Microsoft Patch Tuesday for May 2009 

05-12-2009 02:58 PM

Hello and welcome to this month’s blog on the Microsoft patch releases. This is a light, yet moderate month—the vendor is releasing one bulletin covering a total of 14 vulnerabilities. This is the first time we've seen a single bulletin cover so many vulnerabilities since Microsoft started the monthly patch program.

All the issues are remote code-execution vulnerabilities in PowerPoint, and Microsoft has rated 11 of them “Critical.” For any of these issues to be triggered, a victim must open a specially crafted file with a vulnerable version of PowerPoint.

As always, customers are advised to follow these security best practices:

- Install vendor patches as soon as they are available.
- Run all software with the least privileges required while still maintaining functionality.
- Avoid handling files from unknown or questionable sources.

Microsoft’s summary of the May releases can be found here:

http://www.microsoft.com/technet/security/bulletin/ms09-may.mspx

The following is a breakdown of the issues being addressed this month:

1. MS09-017 Vulnerabilities in Microsoft Office PowerPoint Could Allow Remote Code Execution (967340)

CVE-2009-0220 (BID 34833) Microsoft PowerPoint Paragraph Data Remote Code Execution Vulnerability (MS Rating: Critical / Symantec Urgency Rating 7.1/10)

A remote code execution vulnerability affects PowerPoint when processing paragraph formatting data. An attacker can exploit this issue by tricking an unsuspecting victim into opening a specially crafted PowerPoint 4.0 file. A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the currently logged-in user.

Affects: Microsoft Office PowerPoint 2000 SP3, 2002 SP3 and 2003 SP3

CVE-2009-0221 (BID 34835) Microsoft Powerpoint Invalid Record Integer Overflow Vulnerability (MS Rating: Important / Symantec Urgency Rating 7.1/10)

A remote code execution vulnerability affects PowerPoint when handling an invalid record type. An attacker can exploit this issue by tricking an unsuspecting victim into opening a specially crafted file. A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the currently logged-in user.

Affects: Microsoft Office PowerPoint 2002 SP3 and 2003 SP3

CVE-2009-0222 (BID 34831) Microsoft PowerPoint Sound Data Remote Code Execution Vulnerability (MS Rating: Critical / Symantec Urgency Rating 7.1/10)

A remote code execution vulnerability affects PowerPoint when processing sound data. An attacker can exploit this issue by tricking an unsuspecting victim into opening a specially crafted PowerPoint 4.0 file. A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the currently logged-in user.

Affects: Microsoft Office PowerPoint 2000 SP3, 2002 SP3 and 2003 SP3

CVE-2009-0223 (BID 34834) Microsoft PowerPoint Sound Data Remote Code Execution Vulnerability (MS Rating: Critical / Symantec Urgency Rating 7.1/10)

A remote code execution vulnerability affects PowerPoint when processing sound data. An attacker can exploit this issue by tricking an unsuspecting victim into opening a specially crafted PowerPoint 4.0 file. A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the currently logged-in user.

Affects: Microsoft Office PowerPoint 2000 SP3, 2002 SP3 and 2003 SP3

CVE-2009-0224 (BID 34879) Microsoft PowerPoint Invalid Record Type Remote Code Execution Vulnerability (MS Rating: Critical / Symantec Urgency Rating 7.1/10)

A remote code execution vulnerability affects PowerPoint when handling an invalid record type. An attacker can exploit this issue by tricking an unsuspecting victim into opening a specially crafted file. A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the currently logged-in user.

Affects: Microsoft Office PowerPoint 2000 SP3, 2002 SP3, 2003 SP3, 2007 SP1, and 2007 SP2, Microsoft Office 2004 for Mac, Microsoft Office 2008 for Mac, OpenXML File Format Converter for Mac, Microsoft Office PowerPoint Viewer 2003, Microsoft Office PowerPoint Viewer 2007 SP1 and SP2, Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2, Microsoft Works 8.5, and Microsoft Works 9.0

CVE-2009-0225 (BID 34880) Microsoft PowerPoint Sound Data Remote Code Execution Vulnerability (MS Rating: Important / Symantec Urgency Rating 7.1/10)

A remote code execution vulnerability affects PowerPoint when processing sound data. An attacker can exploit this issue by tricking an unsuspecting victim into opening a specially crafted PowerPoint 95 file. A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the currently logged-in user.

Affects: Microsoft Office PowerPoint 2002 SP3

CVE-2009-0226 (BID 34881) Microsoft PowerPoint Sound Data Remote Code Execution Vulnerability (MS Rating: Critical / Symantec Urgency Rating 7.1/10)

A remote code execution vulnerability affects PowerPoint when processing sound data. An attacker can exploit this issue by tricking an unsuspecting victim into opening a specially crafted PowerPoint 4.0 file. A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the currently logged-in user.

Affects: Microsoft Office PowerPoint 2000 SP3, 2002 SP3 and 2003 SP3

CVE-2009-0227 (BID 34882) Microsoft PowerPoint Sound Data Remote Code Execution Vulnerability (MS Rating: Critical / Symantec Urgency Rating 7.1/10)

A remote code execution vulnerability affects PowerPoint when processing sound data. An attacker can exploit this issue by tricking an unsuspecting victim into opening a specially crafted PowerPoint 4.0 file. A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the currently logged-in user.

Affects: Microsoft Office PowerPoint 2000 SP3, 2002 SP3 and 2003 SP3

CVE-2009-0556 (BID 34351) Microsoft PowerPoint File Parsing Remote Code Execution Vulnerability (MS Rating: Critical / Symantec Urgency Rating 8.9/10)

A previously public (April 2, 2009) remote code execution vulnerability affects PowerPoint because an object is improperly de-referenced during file parsing. An attacker can exploit this issue by tricking an unsuspecting victim into opening a specially crafted file. A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the currently logged-in user.

Affects: Microsoft Office PowerPoint 2000 SP3, 2002 SP3, 2003 SP3 and Microsoft Office 2004 for Mac

CVE-2009-1128 (BID 34837) Microsoft PowerPoint Sound Data Remote Code Execution Vulnerability (MS Rating: Critical / Symantec Urgency Rating 7.1/10)

A remote code execution vulnerability affects PowerPoint when processing sound data. An attacker can exploit this issue by tricking an unsuspecting victim into opening a specially crafted PowerPoint 95 file. A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the currently logged-in user.

Affects: Microsoft Office PowerPoint 2000 SP3, 2002 SP3 and 2003 SP3

CVE-2009-1129 (BID 34839) Microsoft PowerPoint Sound Data Remote Code Execution Vulnerability (MS Rating: Critical / Symantec Urgency Rating 7.1/10)

A remote code execution vulnerability affects PowerPoint when processing sound data. An attacker can exploit this issue by tricking an unsuspecting victim into opening a specially crafted PowerPoint 95 file. A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the currently logged-in user.

Affects: Microsoft Office PowerPoint 2000 SP3, 2002 SP3 and 2003 SP3

CVE-2009-1130 (BID 34840) Microsoft PowerPoint Malformed Structure Heap Memory Corruption Remote Code Execution Vulnerability (MS Rating: Important / Symantec Urgency Rating 7.1/10)

A remote code execution vulnerability affects PowerPoint when reading a malformed structure value. An attacker can exploit this issue by tricking an unsuspecting victim into opening a specially crafted file. A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the currently logged-in user.

Affects: Microsoft Office PowerPoint 2002 SP3, 2003 SP3 and Microsoft Office 2004 for Mac

CVE-2009-1131 (BID 34841) Microsoft PowerPoint Data Out of Bounds Remote Code Execution Vulnerability (MS Rating: Critical / Symantec Urgency Rating 7.1/10)

A remote code execution vulnerability affects PowerPoint when processing excessive data. An attacker can exploit this issue by tricking an unsuspecting victim into opening a specially crafted file. A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the currently logged-in user.

Affects: Microsoft Office PowerPoint 2000 SP3

CVE-2009-1137 (BID 34876) Microsoft PowerPoint Sound Data Remote Code Execution Vulnerability (MS Rating: Critical / Symantec Urgency Rating 7.1/10)

A remote code execution vulnerability affects PowerPoint when processing sound data. An attacker can exploit this issue by tricking an unsuspecting victim into opening a specially crafted PowerPoint 4.0 file. A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the currently logged-in user.

Affects: Microsoft Office PowerPoint 2000 SP3, 2002 SP3 and 2003 SP3

 

 


 

 

 

 

More information on this and the other vulnerabilities being addressed this month is available at Symantec’s free SecurityFocus portal and to our customers through the DeepSight Threat Management System.

 

 

 

 

 

 

 

 

 

Message Edited by Robert Keith on 05-12-2009 11:59 AM

Statistics
0 Favorited
0 Views
0 Files
0 Shares
0 Downloads

Tags and Keywords

Related Entries and Links

No Related Resource entered.