[ insider_reports_insider ]
Microsoft Posts Excel Advisory
David Utter
Staff Writer
2006-06-20
 Insider Reports RSS Feed
A recent advisory posted by Microsoft in response to a report of a remote code execution vulnerability in Excel confirmed the existence of the flaw.
 | | Microsoft Posts Excel Advisory |  |
Several versions of Microsoft's spreadsheet program Excel, used globally by millions of users, contain the remote code execution vulnerability Microsoft disclosed on June 16th. An attack on Excel can take place if a user opens a malicious Excel document sent as an email attachment.
After researching the issue, Microsoft provided a security advisory about the problem. Presently, Microsoft describes the problem as "Improper memory validation in Microsoft Excel."
If a user with local administrative rights opens the malicious file, the attacker could gain the same rights on the system. Users with more restricted rights would be less vulnerable to exploitation from those attacks.
Microsoft listed some workarounds for the problem while it develops a fix. The most obvious workaround suggests that users do not open or save Excel files received from untrusted sources. In Excel 2000, double-clicking an attached Excel file automatically launches Excel to open it; later versions of Excel prompt the user to open, save, or cancel that action.
An advisory posted by Secunia rated the flaw as Extremely Critical. The research firm confirmed the flaw exists on Excel 2003 SP2 running on a fully updated Windows XP SP2 system.
This zero-day issue is already being exploited, according to Secunia. Microsoft said in its initial advisory that a single customer had reported the problem, prompting its announcement of the issue on June 16th.
---
Tags: Microsoft, Excel
Add to  Del.icio.us |  Digg |  Yahoo! My Web |  Furl
Get all the updates in RSS: 
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More insider_reports_insider Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
