Signature Detail

HTTP: Microsoft Excel File SST Parsing Integer Overflow

This signature detects attempts to exploit a known vulnerability in the Microsoft Excel file format. A successful attack can lead to an integer overflow and arbitrary remote code execution within the context of the client.

Extended Description

Autonomy KeyView module is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data before copying it to insufficiently sized buffers. Exploiting this issue will allow an attacker to corrupt memory and cause denial-of-service conditions or potentially to execute arbitrary code in the context of an application using the module. Multiple products using the KeyView module are affected.

Affected Products

• Autonomy keyview_export_sdk 10
• Autonomy keyview_export_sdk 10.3.0
• Autonomy keyview_export_sdk 10.4.0
• Autonomy keyview_export_sdk 7
• Autonomy keyview_export_sdk 8
• Autonomy keyview_export_sdk 9
• Autonomy keyview_filter_sdk 10
• Autonomy keyview_filter_sdk 10.3.0
• Autonomy keyview_filter_sdk 10.4.0
• Autonomy keyview_filter_sdk 7
• Autonomy keyview_filter_sdk 8
• Autonomy keyview_filter_sdk 9
• Autonomy keyview_viewer_sdk 10
• Autonomy keyview_viewer_sdk 10.3.0
• Autonomy keyview_viewer_sdk 10.4.0
• Autonomy keyview_viewer_sdk 7
• Autonomy keyview_viewer_sdk 8
• Autonomy keyview_viewer_sdk 9
• Ibm lotus_notes 5.0.12
• Ibm lotus_notes 5.0.3
• Ibm lotus_notes 6.0.0
• Ibm lotus_notes 6.0.1
• Ibm lotus_notes 6.0.2
• Ibm lotus_notes 6.0.3
• Ibm lotus_notes 6.0.4
• Ibm lotus_notes 6.0.5
• Ibm lotus_notes 6.5.0
• Ibm lotus_notes 6.5.1
• Ibm lotus_notes 6.5.2
• Ibm lotus_notes 6.5.3
• Ibm lotus_notes 6.5.4
• Ibm lotus_notes 6.5.5
• Ibm lotus_notes 6.5.5 FP2
• Ibm lotus_notes 6.5.5 FP3
• Ibm lotus_notes 6.5.6
• Ibm lotus_notes 6.5.6 FP2
• Ibm lotus_notes 7.0
• Ibm lotus_notes 7.0.1
• Ibm lotus_notes 7.0.2
• Ibm lotus_notes 7.0.2 FP1
• Ibm lotus_notes 7.0.3
• Ibm lotus_notes 8.0
• Ibm lotus_notes 8.5
• Ibm lotus_notes
• Symantec brightmail_appliance 5.0
• Symantec brightmail_appliance 8.0
• Symantec brightmail_appliance 8.0.1
• Symantec data_loss_prevention_detection_servers 7.2
• Symantec data_loss_prevention_detection_servers_for_linux 8.1.1
• Symantec data_loss_prevention_detection_servers_for_linux 9.0.1
• Symantec data_loss_prevention_detection_servers_for_windows 8.1.1
• Symantec data_loss_prevention_detection_servers_for_windows 9.0.1
• Symantec data_loss_prevention_endpoint_agents 8.1.1
• Symantec data_loss_prevention_endpoint_agents 9.0.1
• Symantec mail_security_appliance 5.0.0
• Symantec mail_security_appliance 5.0.0.24
• Symantec mail_security_appliance 5.0.0-36
• Symantec mail_security_for_domino 7.5.3.25
• Symantec mail_security_for_domino 7.5.4.29
• Symantec mail_security_for_domino 7.5.5.32
• Symantec mail_security_for_domino 7.5.6
• Symantec mail_security_for_domino 8.0
• Symantec mail_security_for_microsoft_exchange 5.0.10
• Symantec mail_security_for_microsoft_exchange 5.0.10.382
• Symantec mail_security_for_microsoft_exchange 5.0.11
• Symantec mail_security_for_microsoft_exchange 5.0.12
• Symantec mail_security_for_microsoft_exchange 6.0.6
• Symantec mail_security_for_microsoft_exchange 6.0.7
• Symantec mail_security_for_microsoft_exchange 6.0.8
• Symantec mail_security_for_smtp 5.0
• Symantec mail_security_for_smtp 5.0.1
• Symantec mail_security_for_smtp 5.0.1 Patch 181
• Symantec mail_security_for_smtp 5.0.1 Patch 182
• Symantec mail_security_for_smtp 5.0.1 Patch 189
• Symantec mail_security_for_smtp 5.0.1 Patch 200
• Symantec mail_security_for_smtp 5.0.1 Patch 201

References

• BugTraq: 36042
• CVE: CVE-2009-3037