dbcve.org
Isa ServerApplication · Microsoft

CVE-2009-0562

HIGH · 9.3 CVSS v2.0 Published 2009-08-12
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
The Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, Office 2003 Web Components SP1 for the 2007 Microsoft Office System, Internet Security and Acceleration (ISA) Server 2004 SP3 and 2006 SP1, and Office Small Business Accounting 2006 does not properly allocate memory, which allows remote attackers to execute arbitrary code via unspecified vectors that trigger "system state" corruption, aka "Office Web Components Memory Allocation Vulnerability."

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

The Office Web Components ActiveX Control contains a memory allocation vulnerability where improper memory handling triggers system state corruption, allowing remote attackers to execute arbitrary code via specially crafted web pages or documents that instantiate the vulnerable ActiveX control.

MitigationApply the relevant Microsoft security patches (MS09-017) to all affected Office and ISA Server installations, or disable the Office Web Components ActiveX control in Internet Explorer if the functionality is not required.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Isa ServerApplication
Affected:= 2004= 2006
OfficeApplication
Affected:all versions= 2003= xp
Office Web ComponentsApplication
Affected:= 2000= 2003= xp

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
M
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete

AV:N/AC:M/Au:N/C:C/I:C/A:C

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Check for Office Web Components installation
    Search for OWC (Office Web Components) DLL files on the system: typical paths include C:\Program Files\Microsoft Office\ or subdirectories. Look for files named OWC10.DLL, OWC11.DLL, or OWC12.DLL. Use command: dir /s C:\OWC*.DLL or search via PowerShell: Get-ChildItem -Path C:\ -Recurse -Filter "OWC*.DLL" -ErrorAction SilentlyContinue
    Affected if Any OWC DLL version 2000, 2003, or XP (OWC10/OWC11) is found on the system
  2. Check Windows registry for ActiveX control registration
    Search registry for the CLSID of Office Web Components. The known CLSID is {0002E541-0000-0000-C000-000000000046} for OWC Spreadsheet. Run: reg query "HKLM\SOFTWARE\Classes\CLSID\{0002E541-0000-0000-C000-000000000046}" or use PowerShell to query the CLSID key
    Affected if The Office Web Components CLSID is registered in the system registry, indicating the ActiveX control is installed and can be instantiated by Internet Explorer
  3. Identify installed Microsoft Office version
    Check the installed Office version via registry: reg query "HKLM\SOFTWARE\Microsoft\Office\10.0\Common\InstallRoot" (for XP), reg query "HKLM\SOFTWARE\Microsoft\Office\11.0\Common\InstallRoot" (for 2003), or check Program Files for Microsoft Office folder names. Use: dir "C:\Program Files\Microsoft Office"
    Affected if Any version of Microsoft Office is installed, particularly versions 2003 or XP (Office 10/11), as these bundle or commonly install Office Web Components
  4. Check if ISA Server 2004 or 2006 is installed
    Verify ISA Server installation by checking: reg query "HKLM\SOFTWARE\Microsoft\ISA Server\Setup" or look for Microsoft ISA Server in Programs. Also check services for "Microsoft Firewall" or "ISA Server" service status
    Affected if Microsoft ISA Server version 2004 or 2006 is installed, as these versions include affected Office Web Components
  5. Verify Internet Explorer ActiveX control behavior
    Open Internet Explorer, go to Tools > Internet Options > Security > Custom Level. Look for settings under "ActiveX controls and plugins" section, specifically "Run ActiveX controls and plugins" and "Script ActiveX controls marked safe for scripting". Alternatively, view installed add-ons in IE: Manage Add-ons > Enable or Disable Add-ons
    Affected if ActiveX controls are enabled in Internet Explorer, which would allow the vulnerable OWC ActiveX control to be instantiated when visiting a malicious webpage

The system is affected if Office Web Components (OWC10.DLL or OWC11.DLL) are installed, or if any affected Microsoft Office/ISA Server version is present, AND Internet Explorer has ActiveX controls enabled, allowing the vulnerable control to be instantiated via specially crafted web pages.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Apply the relevant Microsoft security patches (MS09-017) to all affected Office and ISA Server installations, or disable the Office Web Components ActiveX control in Internet Explorer if the functionality is not required.

Recommended fix High confidence

Microsoft 365 or Office 2016/2019/365 (perpetual) - these versions do not include the vulnerable Office Web Components ActiveX control

  1. 1. Identify all systems with affected Microsoft Office XP, Office 2003, Office Web Components, ISA Server 2004/2006, and Small Business Accounting 2006 installations.
  2. 2. Prioritize external-facing or internet-connected systems given the remote code execution risk.
  3. 3. Migrate to supported Microsoft 365 or Office 2016/2019/365 versions which no longer include the vulnerable Office Web Components ActiveX control by default.
  4. 4. If migration is not immediately feasible, apply the MS09-043 security update from Microsoft for each affected product (Office XP SP3, Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, Office 2003 Web Components SP1 for 2007 Office System, ISA Server 2004 SP3, ISA Server 2006 SP1, Small Business Accounting 2006).
  5. 5. After patching, verify the Office Web Components ActiveX control (owc10.dll, owc11.dll) is either patched or disabled via killbit in Internet Explorer.
  6. 6. Test that patched Office functionality remains operational.
Caveat Upgrading from Office XP/2003 to Microsoft 365 may introduce UI changes, file format compatibility considerations (ensure compatibility mode for legacy documents), and require subscription licensing; older Windows versions may not support newer Office releases

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Isa Server Scoped from the published advisory
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing6.0 h
  • Review / QA2.0 h
20.0 hours of engineering $3,500
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,600.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2009-0562 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2009-0562 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data