CVE-2009-1136

EXPLOITED IN THE WILD

Microsoft Isa Server - Code Injection

Title source: rule

Description

The Microsoft Office Web Components Spreadsheet ActiveX control (aka OWC10 or OWC11), as distributed in Office XP SP3 and Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, Office 2003 Web Components SP1 for the 2007 Microsoft Office System, Internet Security and Acceleration (ISA) Server 2004 SP3 and 2006 Gold and SP1, and Office Small Business Accounting 2006, when used in Internet Explorer, allows remote attackers to execute arbitrary code via a crafted call to the msDataSourceObject method, as exploited in the wild in July and August 2009, aka "Office Web Components HTML Script Vulnerability."

Exploits (3)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/16537
exploitdb WORKING POC VERIFIED
by anonymous · textdoswindows
https://www.exploit-db.com/exploits/9163
metasploit WORKING POC NORMAL
by unknown, hdm, Ahmed Obied · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms09_043_owc_msdso.rb

References (9)

Scores

EPSS 0.8608
EPSS Percentile 99.4%

Details

VulnCheck KEV 2009-07-15
InTheWild.io 2018-10-12
CWE
CWE-94
Status published
Products (6)
microsoft/isa_server 2004 sp3 (2 CPE variants)
microsoft/isa_server 2006 (3 CPE variants)
microsoft/office 2003 (2 CPE variants)
microsoft/office_web_components 2003 sp1 (2 CPE variants)
microsoft/office_web_components xp sp3
microsoft/office_xp sp3
Published Jul 15, 2009
Tracked Since Feb 18, 2026