[ insider_reports_insider ]
Zero Day Excel Threat Vexes Microsoft
David Utter
Staff Writer
2008-01-17
 Insider Reports RSS Feed
Public disclosure of a newly found vulnerability in several versions of the Microsoft Excel spreadsheet program have the software company racing to repair it.
 | | Zero Day Excel Threat Vexes Microsoft |  |
When someone drops details of a flaw on the Internet, especially those related to remote code execution, it places users of the software at virtually an immediate risk. With the software being Excel, arguably the most important piece of Office and in use on millions of desktops globally, the threat increases dramatically.
In the latest Microsoft security advisory, the company again took those responsible for publicly disclosing a vulnerability to task. "We believe the commonly accepted practice of reporting vulnerabilities directly to a vendor serves everyone's best interests. This practice helps to ensure that customers receive comprehensive, high-quality updates for security vulnerabilities without exposure to malicious attackers while the update is being developed," the advisory said.
There are arguments for and against such public disclosure. We won't recount those here, other than to note that once upon a time, software companies were not nearly as responsive to submitted security vulnerability reports as they are today.
In this latest advisory, several version of Excel, and including the Microsoft Office Excel Viewer 2003, could fall victim to an exploit. Microsoft said the vulnerability could be exploited when a user opens a specially crafted file.
To succeed, an attacker has to convince someone to either open a malicious Excel file attached to an email. Or, the file could be hosted on a website where the criminals would try and get people to download it.
Excel versions 2000 through 2007, and Excel 2004 and 2008 for Mac, suffer from the vulnerability. Microsoft has not decided whether to issue a fix as part of a monthly patch update, or to release an out-of-band patch. Microsoft rarely goes out-of-band with its updates; if this vulnerability is not being vigorously exploited, it's likely they will wait until February at the earliest to correct it.
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More insider_reports_insider Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
