Jul 06 CVE-2009-3129 XLS Update Report 0702 from ycyeh@mail.moe.gov.tw

CVE-2009-3129 Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset, aka "Excel Featheader Record Memory Corruption Vulnerability." 

 Download   0702g.xls 9b60af61854a4334967377c0d19a4af4  as a password protected archive (contact me if you need the password)

From: ycyeh [mailto:ycyeh@mail.moe.gov.tw]
Sent: Tuesday, July 06, 2010 4:00 AM
To:XXXXXXXXXXXX
Subject: 更新0702週報表

From: ycyeh [mailto: ycyeh@mail.moe.gov.tw]Sent: Tuesday, July 06, 2010 4:00 AMTo: XXXXXXXXXXXXSubject: Update Report 0702 weeks

                                                                     
 File 0702g.xls received on 2010.07.27 05:33:32 (UTC)
http://www.virustotal.com/analisis/3000b45d24d2f958efbba838c27c5dc7e110b0ecd53aa772a46e7c2a0093263b-1280208812
Result: 14/41 (34.15%)
AntiVir    8.2.4.26    2010.07.26    EXP/Excel.CVE-2009-3129
Antiy-AVL    2.0.3.7    2010.07.26    Exploit/Win32.CVE-2009-3129
Authentium    5.2.0.5    2010.07.27    MSExcel/Dropper.B!Camelot
Avast    4.8.1351.0    2010.07.26    Win32:CVE-2009-3129
Avast5    5.0.332.0    2010.07.26    Win32:CVE-2009-3129
Emsisoft    5.0.0.34    2010.07.27    Exploit.Win32.CVE-2009!IK
GData    21    2010.07.27    Win32:CVE-2009-3129
Ikarus    T3.1.1.84.0    2010.07.27    Exploit.Win32.CVE-2009
Kaspersky    7.0.0.125    2010.07.27    Exploit.Win32.CVE-2009-3129.a
McAfee    5.400.0.1158    2010.07.27    Exploit-MSExcel.u
McAfee-GW-Edition    2010.1    2010.07.27    Heuristic.BehavesLike.Exploit.X97.CodeExec.PGPG
Microsoft    1.6004    2010.07.26    Exploit:Win32/CVE-2009-3129
Norman    6.05.11    2010.07.26    ShellCode.A
TrendMicro-HouseCall    9.120.0.1004    2010.07.27    HEUR_OLEXP.B
Additional information
File size: 104510 bytes
MD5...: 9b60af61854a4334967377c0d19a4af4

Headers

Received: from IBM-62979760B13 ([211.75.147.173])
    by msr25.hinet.net (8.9.3/8.9.3) with ESMTP id PAA06994
Reply-To: ycyeh@mail.moe.gov.tw
From: "ycyeh"
To: "=?BIG5?B?tsCktqW/?="
Subject: =?BIG5?B?p/O3czA3MDK2Z7P4qu0=?=
Date: Tue, 6 Jul 2010 16:00:00 +0800

Hostname:    mx3.imedia.com.tw
ISP:    CHTD, Chunghwa Telecom Co., Ltd.
Organization:    Ming Siang Printing Co., Ltd.
Proxy:    None detected
Type:    Broadband
Assignment:    Static IP
Country:    Taiwan tw flag
State/Region:    T'ai-pei
City:    Taipei