[ insider_reports_insider ]
New Excel Flaw Does Exist
David Utter
Staff Writer
2007-01-09
 Insider Reports RSS Feed
A highly critical problem in Microsoft's much-utilized spreadsheet program Excel will be formally disclosed and patched by Microsoft later today.
 | | New Excel Flaw Does Exist |  |
The earlier report of a vulnerability in Excel seemingly hit a wall when we tried to look into further details.
But a link from the Secunia advisory site to Fortinet, which disclosed the problem in Excel, has been updated on Fortinet to clear up the earlier confusion.
The update now contains a new CVE reference, CVE-2007-028, and was confirmed with us by Steve Fossen, manager of antivirus research for Fortinet as valid. Fossen also said Microsoft would issue a patch for this today.
Fortinet's advisory said the problem affects Excel in Office 2000, Office XP, Office 2003, and Microsoft Works Suites on Windows; it also impacts the Mac OS platform in Office 2004 and Office v.X.
The flaw could be exploited in this way, per the advisory:
A remote attacker could construct a .xls file and put it on a controlled website. When the user opens the .xls file with the Microsoft Internet Explorer, the browser will automatically call Microsoft Excel to open the .xls file. And if specially crafted, this will cause Microsoft Excel to crash; then, the .xls may allow the attacker to execute arbitrary code.
This vulnerability is due to Microsoft Excel's manipulation of specific opcode.
Microsoft's update will correct the flaw when the patch is issued later today. As always, people should avoid opening documents from untrusted sources to mitigate such threats.
---
Tag: Excel
Add to  Del.icio.us |  Digg |  Reddit |  Furl
Get all the SecurityProNews updates: 
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More insider_reports_insider Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
