Buffer overflow in Microsoft Office 2000 SP3, XP SP3, and other versions and packages, allows user-assisted attackers to execute arbitrary…

Description

Buffer overflow in Microsoft Office 2000 SP3, XP SP3, and other versions and packages, allows user-assisted attackers to execute arbitrary code via a routing slip that is longer than specified by the provided length field, as exploited by malware such as TROJ_MDROPPER.BH and Trojan.PPDropper.E in attacks against PowerPoint.

Scores

EPSS (exploitation in 30 days)

14.2% · top 3.4% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.1.

Weakness

• n/a

Affected products

• n/a

  • affected n/a

References (36)

• 20060422 PowerPoint Phishing Trojan (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• ADV-2006-3678 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• VU#682820 (opens in a new tab)third-party-advisoryx_refsource_CERT-VNx_transferred
• oval:org.mitre.oval:def:1504 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
• http://www.symantec.com/security_response/writeup.jsp?docid=2006-091810-5028-99 (opens in a new tab)x_refsource_MISCx_transferred
• ADV-2006-0950 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• oval:org.mitre.oval:def:1653 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
• http://www.symantec.com/enterprise/research/SYMSA-2006-001.txt (opens in a new tab)x_refsource_MISCx_transferred
• 20060822 Major updates in PowerPoint FAQ document - not a 0-day issue (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
• 20059 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• 20060314 SYMSA-2006-001: Buffer overflow in Microsoft Office 2000, Office XP (2002), and Office 2003 Routing Slip Metadata (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• http://www.darkreading.com/document.asp?doc_id=101970 (opens in a new tab)x_refsource_MISCx_transferred
• 1016886 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• http://isc.sans.org/diary.php?storyid=1618 (opens in a new tab)x_refsource_MISCx_transferred
• http://blogs.securiteam.com/?author=28 (opens in a new tab)x_refsource_MISCx_transferred
• powerpoint-presentation-code-execution(29009) (opens in a new tab)vdb-entryx_refsource_XFx_transferred
• 17000 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm (opens in a new tab)x_refsource_CONFIRMx_transferred
• 19238 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://blogs.securiteam.com/?p=557 (opens in a new tab)x_refsource_MISCx_transferred
• 20060919 Microsoft PowerPoint 0-day Vulnerability FAQ - September written (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• 1016720 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• http://blogs.securiteam.com/?p=559 (opens in a new tab)x_refsource_MISCx_transferred
• TA06-073A (opens in a new tab)third-party-advisoryx_refsource_CERTx_transferred
• office-routing-slip-bo(25009) (opens in a new tab)vdb-entryx_refsource_XFx_transferred
• 20060919 New PowerPoint 0-day Trojan in the wild (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
• oval:org.mitre.oval:def:798 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
• 19138 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• oval:org.mitre.oval:def:1553 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
• 23903 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 20060819 New PowerPoint 0-day and Trojan - FAQ document ready (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• 20060919 New PowerPoint 0-day Trojan in the wild (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• 20060822 Major updates in PowerPoint FAQ document - not a 0-day issue (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• 1015766 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_MDROPPER.BH (opens in a new tab)x_refsource_MISCx_transferred
• MS06-012 (opens in a new tab)vendor-advisoryx_refsource_MSx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2006-0009](https://trackcve.app/badge/CVE-2006-0009.svg)](https://trackcve.app/cve/CVE-2006-0009)

Record last updated 7 Aug 2024, 16:18 UTC.