Vigilancia Online-Mercados Unidos-Sistemas de Seguridad Electronica-Neuquén

13 julio, 2009

Falla de seguridad pone en alerta a la Web

El Centro de Tormentas de Internet elevó su estado a nivel amarillo por una falla en el Internet Explorer

El Centro de Tormentas de Internet acaba de elevar su estado de alerta a amarillo, luego de que Microsoft publicara que la compañía fue advertida de intentos de explotar una vulnerabilidad existente en los componentes del Internet Explorer que permiten mostrar planillas de cálculo de Excel embebidos en páginas Web .

Más tarde, en una actualización del sitio, el Centro de Tormentas de Internet, dependiente del SANS (por SysAdmin, Audit, Networking, and Security), confirmó que la vulnerabilidad está siendo explotada activamente en sitios web, se entiende que maliciosos o intervenidos por piratas.

Como la vulnerabilidad todavía no ha sido corregida, Microsoft sugiere emplear la solución que ofrece en el documento mencionado arriba y que está simplificada y automatizada aquí: .

Otra posible solución es emplear un navegador alternativo, como Chrome o Firefox hasta tanto la falla haya sido corregida.

Texto Original:

Vulnerability in Microsoft Office Web Components Control Could Allow Remote Code Execution
Published: 2009-07-13,
Last Updated: 2009-07-14 01:35:23 UTC
by Adrien de Beaupre (Version: 8)

Update1: The vulnerability is being actively exploited on web sites. More to follow.

Microsoft has released an advisory related to an Office Web Components ActiveX vulnerability, it is available here. This vulnerability exists in the ActiveX control used by IE to display Excel spreadsheets. The CVE entry for the vulnerability is CVE-2009-1136. Microsoft mentions that they are aware of active exploits against this vulnerability, although we at the SANS Internet Storm Center haven’t seen it used or mentioned in public as of yet (this has changed, we are seeing active exploit pages). Which may tend to indicate it has been used in targeted rather than broad based attacks. At the moment there is no patch, there is a workaround, and it can be automated for enterprise deployment. The specific CLSIDs to set the killbit for are:


Start working on this on ASAP. The impact is remote code execution with the privileges of the logged in user running Internet Explorer, and might not require user intervention. As in browse to a nasty web site and be pwn3d.


KB article:

SRD blog:

MSRC blog:

There is a long list of affected products:

  • Microsoft Office XP Service Pack 3;
  • Microsoft Office 2003 Service Pack 3;
  • Microsoft Office XP Web Components Service Pack 3;
  • Microsoft Office Web Components 2003 Service Pack 3;
  • Microsoft Office 2003 Web Components for the  2007 Microsoft Office system Service Pack 1;
  • Microsoft Internet Security and Acceleration Server 2004 Standard Edition Service Pack 3;
  • Microsoft Internet Security and Acceleration Server 2004 Enterprise Edition Service Pack 3;
  • Microsoft Internet Security and Acceleration Server 2006;
  • Internet Security and Acceleration Server 2006 Supportability Update;
  • Microsoft Internet Security and Acceleration Server 2006 Service Pack 1; and
  • Microsoft Office Small Business Accounting 2006.

For information on how to prevent ActiveX controls from running check out this Microsoft KB article on modifying the registry. This article describes how to deploy using Active Directory. If you have administrative privileges on a single system and are running Internet Explorer, you can click on this ‘fixit‘ link to set the killbit and mitigate the vulnerability on a home computer for example.

Update1: The vulnerability is being actively exploited on web sites. More to follow.

Update2: One other obvious mitigation step is to use an alternate web browser (as in other than IE) that does not make use of ActiveX.

Update3: We have raised the Infocon to yellow for 24 hours due to the active exploitation of this vulnerability.

Update4: We will be updating our existing diary post of domains to block with domains that are hosting this exploit as well.  You can see that diary entry at the following url. (newly added domains are in yellow) – AndreL

Update5: Attack vectors used to exploit this vulnerability.

  1. The now known public attempts to exploit the vulnerability, attackers just modify the code with a fresh download and payload to slightly modified malware.
  2. A .cn domain using a heavily obfuscated version of the exploit – which may become an attack kit (think MPACK)and is similar to recent DirectShow attacks.
  3. A highly targeted attack against an organization earlier today who received a Microsoft Office document with embedded HTML.  This one was particularly nasty, it was specifically crafted for the target – with the document being tailored with appropriate contact information and subject matter that were specific to the targeted recipient. Analysis of the document and secondary payload found the attacker used a firewall on the malicious server so that all IP traffic outside of the targeted victim’s domain/IP range would not reach with the server.

Update6: This blog has additional information, with examples of code that may have been used in this attack. hxxp://!A6B213403DBD59AF!1463.entry (obscured on purpose, some AV products will trigger accessing the page. Another example is here: hxxp://

One part of a signature looking for the exploit would be ActiveXObject(“OWC10.Spreadsheet”), which could also be used for legitimate web applications trying to open a spreadsheet.

Update7: attempt at snort sigs (until something better comes along):

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:”MS 0day Excel ActiveX1 CVE-2009-1136 ref″; flow:from_server, established; content:”0002E559-0000-0000-C000-000000000046″; nocase; pcre:”/<OBJECTs+[^>]*classids*=s*[x22x27]?s*clsids*x3as* x7B?s*0002E559-0000-0000-C000-000000000046/si”;  classtype:attempted-user; sid:1000099; rev:1;)

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:”MS 0day Excel ActiveX2 CVE-2009-1136 ref″; flow:from_server, established; content:”0002E541-0000-0000-C000-000000000046″; nocase; pcre:”/<OBJECTs+[^>]*classids*=s*[x22x27]?s*clsids*x3as* x7B?s*0002E541-0000-0000-C000-000000000046/si”; classtype:attempted-user; sid:1000101; rev:1;)

Update8: Metasploit have released a module exploiting the vulnerability.

If you see exploit code for this vulnerability, or have knowledge of it being used in an attack please let us know via our contact page.

Adrien de Beaupré

Teaching SANS Cutting-Edge Hacking Techniques in Ottawa this September.

Keywords: activex clsid killbits excel Microsoft vulnerability office web objects

El Equipo de MU.


Crea un blog o un sitio web gratuitos con

A %d blogueros les gusta esto: