Microsoft Excel Record Parsing Array Indexing Vulnerability (MS09-021)
25 Jun. 2009
Summary
Microsoft Excel can be exploited through an array-indexing error when processing certain records. This can be exploited to corrupt memory via a specially crafted Excel file. Successful exploitation may allow execution of arbitrary code.
Vulnerable Systems:
* Microsoft Office Excel 2000
* Microsoft Office Excel 2002
* Microsoft Office Excel 2003
* Microsoft Office Excel 2007
* Microsoft Office 2004 for Mac
* Microsoft Office 2008 for Mac
* Open XML File Format Converter for Mac
* Microsoft Office Excel Viewer
* Microsoft Office Compatibility Pack
This security update resolves several privately reported vulnerabilities that could allow remote code execution if a user opens a specially crafted Excel file that includes a malformed record object. An attacker who successfully exploited any of these vulnerabilities could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
The update addresses the vulnerabilities by modifying the way that Excel parses Excel files.
