MS09-010: Vulnerability in WordPad and Office text converters could allow remote code execution

View products that this article applies to.

Introduction

Microsoft has released security bulletin MS09-010. To view the complete security bulletin, visit one of the following Microsoft Web sites:

Home users:
http://www.microsoft.com/protect/computer/updates/bulletins/200904.mspx
Skip the details: Download the updates for your home computer or laptop from the Microsoft Update Web site now:
http://update.microsoft.com/microsoftupdate/
IT professionals:
http://www.microsoft.com/technet/security/bulletin/MS09-010.mspx

How to obtain help and support for this security update

For home users, no-charge support is available by calling 1-866-PCSAFETY in the United States and Canada or by contacting your local Microsoft subsidiary. For more information about how to contact your local Microsoft subsidiary for support issues with security updates, visit the Microsoft International Support Web site:

http://support.microsoft.com/common/international.aspx?rdpath=4

North American customers can also obtain instant access to unlimited no-charge e-mail support or to unlimited individual chat support by visiting the following Microsoft Web site:

http://support.microsoft.com/oas/default.aspx?&prid=7552

For enterprise customers, support for security updates is available through your usual support contacts.

↑ Back to the top

More information

Known issues with this security update

Customers who have applied the workarounds that are listed in security advisory 960906 may experience errors during the installation of this security update. This may cause the update installation to fail. In order to install this security update, you must roll back the workaround before you install this security update. For more information about how to roll back the workaround, click the following article number to view the article in the Microsoft Knowledge Base:
923561� MS09-010: Description of the update for Windows WordPad Converter: April 14, 2009
This security update deploys additional changes to the way that WordPad supports loading of Word 6.0 and Write files.

By default, Windows XP SP2, Windows XP SP3, Windows Server 2003 SP1, and Windows Server 2003 SP2 operating systems already prevent WordPad from parsing Word 6.0 and Write documents by disabling these text converters. Additionally, this mechanism was deployed on other platforms when security update MS04-041 was installed. On these platforms, when you open a Word for Windows 6.0 document, you receive an error message that resembles the following:
Can not load Word for Windows 6.0 files
Write files are parsed as plain text files, but no message is shown. This behavior is described in Microsoft Knowledge Base article 870883. However, it can be disabled by an administrator by using a registry key.

When you install this security update (security update 960477), this behavior is enforced more strictly. This security update adds a second dialog box so that even if this feature is disabled by using a registry key as described in Microsoft Knowledge Base article 870883, the user receives a warning message that resembles the following before the file is opened:
Viewing this file format with Wordpad might result in a security risk. More details are available at http://support.microsoft.com/kb/923561 Are you sure you want to view this file in Wordpad?
We recommend that users use the Word Viewer applications to view older files that can no longer be opened in WordPad. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
891090� How to obtain the latest Word Viewer
If an administrator requires the Word 6 and Write converters, the EnableLegacyConverters registry entry with a DWORD value of 1 can be used to re-enable the converter. To do this, follow these steps:
1. Click Start, click Run, type regedit in the Open box, and then click OK.
2. Locate and then click the following subkey in the registry:
  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad
3. On the Edit menu, point to New, and then click DWORD Value.
4. Type EnableLegacyConverters for the name of the DWORD, and then press ENTER.
5. Right-click EnableLegacyConverters, and then click Modify.
6. In the Value data box, type 1, and then click OK.
7. Exit Registry Editor.
After you set this registry key value, WordPad can open Word 6.0 and Write files. However, the user will still receive the warning message. If the user clicks Yes, WordPad opens the file. If the user clicks No, which is recommended, WordPad exits, and the document does not open.

An additional registry entry can be used to allow for WordPad to open the files without this additional warning message. We do not recommend that you implement this entry. However, it can be used if user behavior should not change after you install this security update. To do this, add the EnableLegacyConvertersNoPopup registry DWORD with a value of 1 to the following subkey:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad
This registry entry works only if the EnableLegacyConverters entry is also enabled.

Additional information about this security update

For more information about this security update, and for information about any known issues with specific releases of this software, click the following article number to view the article in the Microsoft Knowledge Base:

921606� MS09-010: Description of the security update for Office 2000: April 14, 2009

933399� MS09-010: Description of the security update for Office XP: April 14, 2009

960476� MS09-010: Description of the security update for the Office 2003 File Converter Pack: April 14, 2009

923561� MS09-010: Description of the update for Windows WordPad Converter: April 14, 2009

↑ Back to the top

Office file information

The English (United States) version of this software update installs files that have the attributes that are listed in the following tables. The dates and times for these files are listed in Coordinated Universal Time (UTC). The dates and times for these files on your local computer are displayed in your local time and with your current daylight saving time (DST) bias. Additionally, the dates and times may change when you perform certain operations on the files.