This host is installed with Microsoft Office Web Components ActiveX Control and is prone to code execution vulnerability.

Successful exploitation will let the attacker execute arbitrary code which may result in a Denial of Service condition on the affected system. Impact Level: System/Application

Run Windows Update and update the listed hotfixes or download and update mentioned hotfixes in the advisory from the below link. http://www.microsoft.com/technet/security/bulletin/ms09-043.mspx Workaround: Set the killbit for the CLSID {0002E541-0000-0000-C000-000000000046} {0002E559-0000-0000-C000-000000000046} {0002E55B-0000-0000-C000-000000000046} http://support.microsoft.com/kb/240797

- Error exists in the OWC10.Spreadsheet ActiveX control that can be exploited via specially crafted parameters passed to the 'msDataSourceObject()' method. - Error occurs when loading and unloading the OWC10 ActiveX control. - Error exists in the OWC10.Spreadsheet ActiveX control related to the 'BorderAround()' method via accessing certain methods in a specific order. - A boundary error in the Office Web Components ActiveX control which can be exploited to cause a buffer overflow.

Microsoft Office XP/2003 SP 3 and prior Microsoft Visual Studio .NET 2003 SP 1 and prior Microsoft Office XP/2003 Web Components SP 3 and prior Microsoft ISA Server 2004 Standard/Enterprise Edition SP 3 and prior Microsoft ISA Server 2006 Standard/Enterprise Edition SP 1 and prior Microsoft Office 2003 Web Components for 2007 Microsoft Office system SP 1

• http://secunia.com/advisories/35800/
• http://support.microsoft.com/kb/957638
• http://www.microsoft.com/technet/security/advisory/973472.mspx
• http://www.microsoft.com/technet/security/bulletin/ms09-043.mspx
• http://www.vupen.com/english/advisories/2009/1867

---

Updated on 2015-03-25