CVE:CVE-2009-1136
CNNVD:CNNVD-200907-256
Microsoft Office是非常流行的办公软件套件 。
Office Web组件是用于向Web发布电子表格、图表和数据库的COM控件，其中的Spreadsheet ActiveX控件(OWC 10和OWC11)存在内存破坏漏洞。如果用户受骗访问了恶意恶意网页并向该控件，就会导致执行任意指令。
目前这个漏洞正在被挂马攻击广为利用。
solution:Upgrade microsoft isa_server to a higher version than 2004:sp3,2006,2006:sp1,2006:supportability,and avoid the version 2004:sp3,2006,2006:sp1,2006:supportability; Upgrade microsoft office to a higher version than 2003,2003:sp3,and avoid the version 2003,2003:sp3; Upgrade microsoft office_web_components to a higher version than 2003:sp1,2003:sp3,xp:sp3,and avoid the version 2003:sp1,2003:sp3,xp:sp3; Upgrade microsoft office_xp to a higher version than sp3,and avoid the version sp3