More Excel Flaws
Published on 22 Jun 2006 · Filed in News · 250 words (estimated 2 minutes to read)A third Excel flaw has been uncovered in a week, giving Excel users one more thing to worry about and opening one more door for hackers to get into corporate networks.
Here are more details on the third flaw; more details on the second flaw are also available from this article. This posting also has additional information on the latest vulnerability.
Unfortunately, this new flaw is more critical than the second flaw discovered earlier in the week. The second flaw required the user to click a specially-crafted hyperlink inside an Excel document, and the latest version of Excel even displayed a dialog box that had to be dismissed after clicking the link. This new flaw, however, only requires that the user open the Excel document.
These new flaws underscore the need for users to be very wary of unsolicited Office attachments. If you didn’t ask for it, it very well may be a malicious attachment—exercise caution.
In addition, the recent flaw in Microsoft Word and these flaws in Microsoft Excel have contributed to the placement of Microsoft Office on the SANS Top 20 list of vulnerabilities.
UPDATE: In following up on these reports, I came across a few additional links with more information on the vulnerabilities, including information that proof-of-concept code to exploit the second Excel vulnerability was available:
Notice of exploit code availability: http://www.eweek.com/article2/0,1759,1979409,00.asp Secunia advisory on the second Excel flaw: http://secunia.com/advisories/20748/ MSRC response to the second Excel flaw: http://blogs.technet.com/msrc/archive/2006/06/20/437826.aspx US-CERT Vulnerability Note on the second Excel flaw: http://www.kb.cert.org/vuls/id/394444