 |
 |
 |
|
| SecurityProNews > Insider Reports > Insider > New Excel Flaw Does Exist |
[ insider_reports_insider ]New Excel Flaw Does Exist
David Utter Staff Writer 2007-01-09  Insider Reports RSS Feed
A highly critical problem in Microsoft's much-utilized spreadsheet program Excel will be formally disclosed and patched by Microsoft later today.
The earlier report of a vulnerability in Excel seemingly hit a wall when we tried to look into further details. But a link from the Secunia advisory site to Fortinet, which disclosed the problem in Excel, has been updated on Fortinet to clear up the earlier confusion. The update now contains a new CVE reference, CVE-2007-028, and was confirmed with us by Steve Fossen, manager of antivirus research for Fortinet as valid. Fossen also said Microsoft would issue a patch for this today. Fortinet's advisory said the problem affects Excel in Office 2000, Office XP, Office 2003, and Microsoft Works Suites on Windows; it also impacts the Mac OS platform in Office 2004 and Office v.X. The flaw could be exploited in this way, per the advisory: A remote attacker could construct a .xls file and put it on a controlled website. When the user opens the .xls file with the Microsoft Internet Explorer, the browser will automatically call Microsoft Excel to open the .xls file. And if specially crafted, this will cause Microsoft Excel to crash; then, the .xls may allow the attacker to execute arbitrary code.
This vulnerability is due to Microsoft Excel's manipulation of specific opcode. Microsoft's update will correct the flaw when the patch is issued later today. As always, people should avoid opening documents from untrusted sources to mitigate such threats. --- Tag: Excel Add to  Del.icio.us |  Digg |  Reddit |  Furl
Get all the SecurityProNews updates: 
View All Articles by David Utter About the Author: David Utter is a business and technology writer for SecurityProNews and WebProNews. More insider_reports_insider Articles Insider Reports RSS Feed
|
|
 |
iEntry Featured Services: Jayde Member Services | Forums | Freeware | Advertise with Us |
 |
| Contact
Us | Advertise
| Newsletter
Archive | Sitemap
| Submit an
Article | News
Feeds SecurityProNews is an iEntry, Inc.® publication - 1998-2008 All Rights Reserved | Privacy Policy and Legal |
Join the WebProWorld Forums: Click Here |
|
|||||||||||||||||||||||||
