<em style='font-weight:bold;'>(Description Provided by <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2009-3037" target="_blank">CVE</a>)</em> : Buffer overflow in xlssr.dll in the Autonomy KeyView XLS viewer (aka File Viewer for Excel), as used in IBM Lotus Notes 5.x through 8.5.x, Symantec Mail Security, Symantec BrightMail Appliance, Symantec Data Loss Prevention (DLP), and other products, allows remote attackers to execute arbitrary code via a crafted .xls spreadsheet attachment.

IBM and Symantec have released a patch to address this vulnerability. Additionally, it is possible to temporarily work around the flaw by implementing the following workaround: For all products using the KeyView SDK, you can disable the "xlssr.dll" filter by doing one of the following: Removing the xlssr.dll filter module from the affected system(s). Delete or comment out the line referencing "xlssr.dll" from the "KeyView.ini" file distributed with the affected application.

Additionally, for Symantec Mail Security, disabling "content filtering" will prevent exploitation.

Unknown or Incomplete

• CVE ID: 2009-3037 (see also: NVD)
• Bugtraq ID: 36042 36124
• Secunia Advisory ID: 36421 36422 36472 36474
• VUPEN Advisory: ADV-2009-2389
• Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2009-08/0241.html
• Other Advisory URL: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=823
  http://www-01.ibm.com/support/docview.wss?uid=swg21396492
  http://www.vupen.com/english/advisories/2009/2389
• Vendor Specific News/Changelog Entry: http://www-01.ibm.com/support/docview.wss?uid=swg21396492
  http://www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20090825_00
• Vendor URL: http://www.autonomy.com/
• Vendor Specific Advisory URL: http://www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20090825_00

• Joshua J. Drake - iDefense Labs