Back to KEVs

CVE-2009-0238

Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word,...

Basic Information

CVE State
PUBLISHED
Reserved Date
January 20, 2009
Published Date
February 25, 2009
Last Updated
August 07, 2024
Vendor
Microsoft
Product
Office Excel
Description
Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1; and Excel in Microsoft Office 2004 and 2008 for Mac allow remote attackers to execute arbitrary code via a crafted Excel document that triggers an access attempt on an invalid object, as exploited in the wild in February 2009 by Trojan.Mdropper.AC.

CVSS Scores

CVSS v2.0

9.3

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploit Status

Exploited in the Wild
Yes (2009-02-25 16:00:00 UTC) Source

References

http://www.microsoft.com/technet/security/advisory/968272.mspx http://www.vupen.com/english/advisories/2009/1023 https://exchange.xforce.ibmcloud.com/vulnerabilities/48875 http://www.us-cert.gov/cas/techalerts/TA09-104A.html http://www.securityfocus.com/bid/33870 http://www.symantec.com/business/security_response/writeup.jsp?docid=2009-022310-4202-99 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-009 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5968 http://isc.sans.org/diary.html?storyid=5923 http://securitytracker.com/id?1021744 http://blogs.zdnet.com/security/?p=2658

Known Exploited Vulnerability Information

Source Added Date
CVE 2009-02-25 16:00:00 UTC

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Added to KEVIntel