Detections
Analytics
MS09-010: Vulnerabilities in WordPad and Office Text Converters Could Allow Remote Code Execution (960477)
high Nessus Plugin ID 36148
Language:
Synopsis
It is possible to execute arbitrary code on the remote Windows host using a text converter.Description
The remote host contains a version of the Microsoft WordPad and/or Microsoft Office text converters that could allow remote code execution if a specially crafted file is opened.Solution
Microsoft has released a set of patches for Office 2000 and XP as well as the Office 2003 File Converter Pack.See Also
Plugin Details
Severity: High
ID: 36148
File Name: smb_nt_ms09-010.nasl
Version: 1.33
Type: local
Agent: windows
Family: Windows : Microsoft Bulletins
Published: 4/15/2009
Updated: 8/5/2020
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: High
Score: 8.9
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 8.1
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: cpe:/a:microsoft:office, cpe:/a:microsoft:office_converter_pack, cpe:/o:microsoft:windows
Required KB Items: SMB/MS_Bulletin_Checks/Possible
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 4/14/2009
Vulnerability Publication Date: 12/9/2008
Exploitable With
Core Impact
Reference Information
CVE: CVE-2008-4841, CVE-2009-0087, CVE-2009-0088, CVE-2009-0235