« Volver al listado

CVE-2009-2496

Estado: ModificadaAlta (9.3)—

Heap-based buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, Office 2003 Web Components SP1 for the 2007 Microsoft Office System, Internet Security and Acceleration (ISA) Server 2004 SP3 and 2006 SP1, and Office Small Business Accounting 2006 allows remote attackers to execute arbitrary code via unspecified parameters to unknown methods, aka "Office Web Components Heap Corruption Vulnerability."

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (5)

Microsoft — Biztalk ServerMicrosoft — Internet Security AND Acceleration ServerMicrosoft — OfficeMicrosoft — Office WEB ComponentsMicrosoft — Visual Studio .net

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-2496",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": true,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-08-12T17:30:00.767",
  "references": [
    {
      "url": "http://www.securitytracker.com/id?1022708",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.us-cert.gov/cas/techalerts/TA09-223A.html",
      "tags": [
        "US Government Resource"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-043",
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5645",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securitytracker.com/id?1022708",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.us-cert.gov/cas/techalerts/TA09-223A.html",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-043",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5645",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Heap-based buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, Office 2003 Web Components SP1 for the 2007 Microsoft Office System, Internet Security and Acceleration (ISA) Server 2004 SP3 and 2006 SP1, and Office Small Business Accounting 2006 allows remote attackers to execute arbitrary code via unspecified parameters to unknown methods, aka \"Office Web Components Heap Corruption Vulnerability.\""
    },
    {
      "lang": "es",
      "value": "Desbordamiento de búfer basado en memoria dinámica (heap) en el Componentes Office Web  ActiveX Control en Microsoft Office XP SP3, Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, Office 2003 Web Components SP1 para el 2007 Microsoft Office System, Internet Security y Acceleration (ISA) Server 2004 SP3 y 2006 SP1, y Office Small Business Accounting 2006 permite a los atacantes remotos ejecutar arbitrariamente código a través de parámetros no especificados a métodos desconocidos, también conocidos como \"Vulnerabilidad de corrupción de memoria dinámica en componentes de Office Web\"."
    }
  ],
  "lastModified": "2026-06-16T23:09:34.900",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:biztalk_server:2002:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "44BFE3B9-3C8C-4747-AAC0-A10EED857C4B"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:internet_security_and_acceleration_server:2004:sp3:enterprise:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "234D43DB-0FC3-4B94-8883-EEE99A427E69"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:internet_security_and_acceleration_server:2004:sp3:standard:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "64ACA6AB-44C3-4B33-BEA1-04DFF004FA7D"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:internet_security_and_acceleration_server:2006:sp1:enterprise:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CFF01816-AD1A-4D6D-92B3-348D70FC3920"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:internet_security_and_acceleration_server:2006:sp1:std:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EE723FF8-0DC2-46C4-A3FA-953DCAB5612B"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:-:*:small_business_accounting_2006:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F27860CB-929A-47F3-801E-3E69C53FA353"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A332D04D-CC8C-4F68-A261-BA2F2D8EAD1E"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:xp:sp3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79BA1175-7F02-4435-AEA6-1BA8AADEB7EF"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office_web_components:2000:sp3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D86088BB-C81D-4CCE-B7D1-1280818D99A2"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office_web_components:2003:sp1:2007_microsoft_office:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7B654504-9098-4F7F-8CE7-696CF15BCA38"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office_web_components:2003:sp3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0A9C5BA7-0ECB-4101-9DAD-ECAA42C9E0A3"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office_web_components:xp:sp3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B07BEA1E-F032-4E63-8548-C98DD6E05AAA"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:visual_studio_.net:2003:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "85959AEB-2FE5-4A25-B298-F8223CE260D6"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}