Vulnerability in Microsoft Office Web Components Control Could Allow Remote Code Execution

Microsoft has released an advisory related to an Office Web Components ActiveX vulnerability, it is available here. This vulnerability exists in the ActiveX control used by IE to display Excel spreadsheets. The CVE entry for the vulnerability is CVE-2009-1136. At the moment there is no patch, but there is a workaround, and it can be automated for enterprise deployment. The specific CLSIDs to set the killbit for are:

{0002E541-0000-0000-C000-000000000046}
{0002E559-0000-0000-C000-000000000046}

Start working on this on ASAP. The impact is remote code execution with the privileges of the logged in user running Internet Explorer, and might not require user intervention. As in browse to a nasty web site and be pwn3d.

Microsoft Security Research & Defense - More information about the Office Web Components ActiveX vulnerability

Microsoft Security Response Centre - Microsoft Security Advisory 973472 Released

There is a long list of affected products:

* Microsoft Office XP Service Pack 3;
* Microsoft Office 2003 Service Pack 3;
* Microsoft Office XP Web Components Service Pack 3;
* Microsoft Office Web Components 2003 Service Pack 3;
* Microsoft Office 2003 Web Components for the 2007 Microsoft Office system Service Pack 1;
* Microsoft Internet Security and Acceleration Server 2004 Standard Edition Service Pack 3;
* Microsoft Internet Security and Acceleration Server 2004 Enterprise Edition Service Pack 3;
* Microsoft Internet Security and Acceleration Server 2006;
* Internet Security and Acceleration Server 2006 Supportability Update;
* Microsoft Internet Security and Acceleration Server 2006 Service Pack 1; and
* Microsoft Office Small Business Accounting 2006.

More Info via SANS Internet Storm Center