RSSNew Vulnerability Hits Microsoft Excel
By the Betanews Staff | Published June 16, 2006, 4:34 AM
Just two days after releasing 12 patches to correct 21 security issues in its products, including a critical flaw in Word, Microsoft says it is investigating a report of a new vulnerability affecting Excel, the company's spreadsheet software. So far only one Microsoft customer has been hit by the attack.
"Here's what we know: In order for this attack to be carried out, a user must first open a malicious Excel document that is sent as an email attachment or otherwise provided to them by an attacker," explained Mike Reavey from the Microsoft Security Response Center. Microsoft has updated the Windows Live Safety Center to remove the malware that exploits the security flaw, and says it is sharing information with partners so their software can detect attacks as well.
SWISS CHEESE is still always going to be swiss cheese no matter how many times they try to fill the holes.
GET OVER IT MS FANBOYS! (immo of an immo)
Score: 0
|Couldn't think of anything new to write?
Score: 0
|Wow, how original, now lets get the secunia mailing list for today and see how many linux apps have had security holes announced. Oh look, 40+. IMAGINE THAT. Why dont you stop bad mouthing and learn what you are talking about before you speak.
Score: 0
|Obviously a 12-year old Linux zealot. Making the rest of us 12-year old Linux zealots look bad.
Score: 0
|How does this attach work? It just require to open the file or it has to require a user to run it's macro in the file? If it's going to be case 1, then it's an Excel vulnerable, if case 2, it's the user problem.
Score: 0
|Personally, I still cannot decide as to whether it is a macro or not matters. The user should be responsible for what files they open...especially when those files can contain executable code.
I don't know about anybody else, but I don't just open any old document that crosses my path.
Score: 0
|In the mean time a fresh install of Ubuntu6.06 had 69 updates for me to download. That is 69 freaking patches in two weeks of release of the best linux distro.
Score: 0
|To clarify this to others, I just had 64 when I got up this morning - almost all were the files which make up Gnome.
So basically updates to the Gnome system hardly constitute the implied idea of 69 "security" patches. Did you look at what they were? Tweaks to Gnome games and the game-data files, graphic driver updates, etc...
Yes, there are some security fixes amongst them, but it's mainly just a regular gathering together of all the recent work people have been doing on Gnome to keep it up to date. Those guys don't just stop coding, you know!
Score: 0
|Ummm no, the linux kernel was replaced to avoid a DoS attack and prevent leak in the AMD numeric coprocessor.
http://www.net-security.org/advisory.php?id=6401
And it requires you to reboot after installation too!
Its time to stop headlining every security patch released for Microsoft products while we happily ignore all other OSes.
Score: 0
|That best linux distro includes hundreds of applications and pieces, unlike an OS that contains just the OS. It's also not just security patches, it's functionality. It's not comparable.
Score: 0
|When Microsoft has a < 5% desktop marketshare, then let's see about it's patches getting less scrutiny. Deal?
Score: 0
|Any idea what the marketshare breakdown is in the server market area?
I'd like to see all security vulnerabilities get equal billing.
Score: 0
|I really can't think of any modern OS that "contains just the OS". That doesn't stop others from calling patches for non-critical included applications "OS Updates".
Score: 0
|There is a certain defineable boundary.
All windows and Mac Operating systems contain mostly the OS with few third party applications (exception to windows being adobe Flash.) I consider "notepad" and "wordpad" as part of the OS as they aren't third party controlled, like Linux distributions typically have. SO when you criticize a linux dist for it's vulnerabilities, you criticize more than the OS. Damn Small Linux, one of the most barebones linux Dists out there, doesn't have as many security vulns as ubuntu.
Score: 0
|What servers? web? Apache. Enterprise? education? That is an open ended question that isn't answerable without context. I could say far more critical are routers, since they are public, they are vital for the net, and they serve us all.
"I'd like to see all security vulnerabilities get equal billing."
Go to Secunia or securityfocus. BN likely has editors that just cover major holes that impact it's target audience.
Score: 0
|"There is a certain defineable boundary."
Not really. Even computer scientists draw the line. You are distinguishing it by who produces the included application. That is quite an arbitrary line to draw. Why not distinguish it by the actual author of the code, or the compiler used. Most would define an OS by a base level of functionality. In the most stripped down definition, an OS does not require a user shell.
If Linux can't be held accountable for the applications most common in its multitude of distributions, then Windows can't be held accountable for notepad. Heck, some people argue that vulnerabilities listed for Linux that are actually for common apps should be listed for Windows as well, based on the idea that Windows can usually run them...but windows doesn't come with them, and 99% of Windows users will never even try to install them. Most linux users will get them mixed in with the "umpteen billion" other little apps that come installed automatically.
Score: 0
|Who writes most of the stuff to take advantage of security holes - which aren't usually found in general until someone searches and exploits them. Thats right! anti Microsoft people (why else would you write stuff to cripple something you like?) and anti Microsoft people are mostly - Linux users!
Score: 0
|...and Mac users too. Sometimes this lot is very fanatical.
Score: 0
|But it takes too much work to type real program code on a machine that uses a 1-button mouse. :)
Score: 0
|