Second New Flaw Discovered in Excel

By Ed Oswald | Published June 20, 2006, 5:19 PM

As Microsoft scrambles to fix one security flaw in its Excel spreadsheet program, security researchers have uncovered another. First disclosed by Symantec on Monday, the problem could cause Excel to crash after a malicious file is opened.

While a code execution and system takeover risk is also possible, it has not been confirmed, said Symantec. However, security firm Secunia disagreed, saying successful exploitation would allow the execution of arbitrary code.

Additionally, Secunia reported that it had not been notified of any available exploit code or instances of attempts to take advantage of the flaw. But yet again there was disagreement, with Symantec saying exploit code was available.

"The vulnerability is caused due to a boundary error in hlink.dll within the handling of Hyperlinks in e.g. Excel documents," Secunia wrote in its advisory. "This can be exploited to cause a stack-based buffer overflow by tricking a user into clicking a specially crafted Hyperlink in a malicious Excel document."

Both firms suggested refraining from opening untrusted Office documents as a precaution. Microsoft had no immediate comment on this latest issue.

The disclosure came shortly after Microsoft issued a security advisory for the vulnerability in Excel that was disclosed by the company's Security Response Center on Friday. According to Microsoft, Zero-day attacks are being carried out against a vulnerability in Excel 2000, 2002, 2003 and Excel 2004 for Mac.

The exploit, currently being sent via e-mail, could give an attacker the same rights as a user, which could lead to a full system compromise. Although Excel 2002 and 2003 prompt a user before opening a potentially malicious Excel file, Excel 2000 does not.

This second vulnerability affects Excel 2000, 2002, 2003 as well as the Excel Viewer. The fully patched version of Excel 2003 SP2 also includes the flaw, Secunia says.

Microsoft has not said whether it plans to address either issue before the next monthly security updates scheduled for July 11. However, if the past is any guide, it's fairly unlikely that the Redmond company will issue an out-of-cycle patch.

Comments

View comments by with a score of at least

SWISS CHEESE IS ALWAYS GOING TO BE SWISS CHEESE

ROTFLMAO@Windoze

Score: 0

|

Too bad for you that the article is not talking about the Windows OS nor anything bundled with it. Your cut and paste troll comment doesn't apply here.

Score: 0

|

Please learn what you are talking about and RTFA before posting. We understand you hate windows, but for you to troll like this, is very unnecessary and looks just like a plea for attention. Mommy and daddy not paying enough attention to ya?

Score: 0

|

Heck, I've had that bug in Excel, Word, Power Point, IE, Dreamweaver, Homesite, Lotus 1-2-3, etc since I started working with computers.

I can't believe that if they didn't have a fix for this by now, they won't have a fix for it soon.

HA HA HAHAHAHAHAHAHA

Score: 0

|

mmm, this maybe true to a point. It is the way the OS is built and how it integrates with itself. On a Windows box I can go in and start nuking system files, reboot and no OS, can't do that inlinux unless root and still hard a that point. Windows XP req MANY files to boot and run, I can install and run linux from a floppy. Will it do much? Hell no but, it is a functioning OS. Where was I going with this, heh , oh well, thats ADD for ya :P

Score: 0

|

So what? *IF* you login as root, which is what, the administrator.. fine. Same with windows, the proper way to use Windows is to have a user account *AND* an admin account, we can do it that way. You limit the user account, and only login using it on a daily basis. You want to make changes and install drivers/software? You login as local administrator.

This isn't a Linux feature, its a UNIX education, Windows people do this too, at least those with common sense.

What else you got, because this isn't unique? Nice try, but Linux is JUST as vulnerable, just not on the same scale. You 17 users that use Linux we don't worry about the minority..

*I can install and run linux from a floppy. Will it do much? Hell no but, it is a functioning OS.*

And, I can boot a full windows from a 256 meg flash drive, so what?

*Where was I going with this, heh , oh well, thats ADD for ya :P*

Rambling and talking to yourself it would appear, you haven't mentioned anything useful.

Score: 0

|

I think you're trying to say Linux sucks. Oh and that you didn't read the actual article about excel just the comments below. :)

ps I run both OS's so don't even bother with the fanboy comments. I still stand by it tho, Linux sucks ass.

Score: 0

|

OK, next time I will post who I am replying too..thats my fault..above post was on eriqcook's comments

Score: 0

|

Try and use quickbooks 06 this way. Good luck. It needs admin to patch it, which is frequent. We also have payroll software that requires admin to run, highly irritating, as those our our most important users to be secured. we run multiple layers of security on all those machines.

Score: 0

|

OK, Key word there being "quickbooks". That is an application limitation, not an OS limitation. I can't help that some application can't conform to simple standards. Microsoft can't dicate to them how they will function either, quickbooks needs to fix the problem, or you should try another software package, like.. gee, let's just pick one at random, oh.. let's say MONEY!! Oh, IT happens to be a (surprise) Microsoft App!.. Wow, what a coincidence!

This too, kills me. If you know the product sucks, why continue to use it? If the product won't ALLOW you to do things the way YOU want them to, um.. quit using them!

Another part of this, is Administrator account has default parameters. If you start from the user account and ADD to them, you will pull your hair out trying to figure out how to give enough rights to make it work.

copy the administrators groups account, and create ANOTHER account like "quickbooks". Then save that group. Now take away rights from that group so they can't do things like modify registry, change desktop, reset accounts, whatever.. if you take rights away from the group its much easier than trying to figure out which rights to GIVE a particular account.

We did this on our Great Plains people, same as you, it required Admin rights.. we were like "uh uh". Nope, not on our term server. They were given rights as a power user, and we eventually figured out that administrators has cascading rights in the registry, if you "reset" permissions on the registry, after copy the administrators group, our lives became much easier.

GP users do NOT have admin rights, despite support calls, and yet they do have FULL rights to the app, with NO errors.

Score: 0

|

that is an application limitation, not an OS limitation.

Nailed that one.

Key word there being "quickbooks".

That should really have been the end of the post, though. I mean, what more needs to be said. ;)

Score: 0

|

Name a better small business accounting app?

*crickets chirp*

I didn't think so. And no it's not great plains, quicken has decades more experience in this are than MS. It's not just quicken, it's other payroll applications. As Head of IT, I don't always get to pick the applications our people use, other factors such as political, price, UI, etc go into decisions. Several of these accounting apps require admin use to self-update. To date putting on a good AV, training the user, hasn't resulted in a problem.

Score: 0

|

Name a better small business accounting app?

Being a little subjective?

The comment was made in jest. Please do not ever make the mistake of taking anything I say seriously. Seriously.

No, really... I mean it.

Seriously...

;)

...just sayin'.

Score: 0

|

you know maybe quicken? or say money....

Score: 0

|

Why are they making this look so serious? Any dominant OS/software is going to be focused on by everybody. I'm not a Microsoft "fan", but any company/software that is dominent is gonna cause people to find flaws in every way. I already see Linux/Mac users saying "Use us, and your problems will be over." Really, that's not true. If Mac or Linux were the dominant software, people would find flaws with them as well.

Score: 0

|

Amen! Well said.

Score: 0

|

A bad day for Office is *still* better than a good day with OpenOffice.

*dons flameproof suit*

This flamebait brought to you by...

...aw, bite me. ;)

Score: 0

|

I agree OpenOffice is ass. As for the stupid people that are going to be affected by this bug - stop downloading unknown files from your email. Dummies.

Oh I forgot, Linux Sucks. Take that losers.

Score: 0

|

awww, don't be ashamed if you don't know how to use Linux. It's ok, I'll still accept you as a Windows user.
Freedom of choice, right?
Use what you like and what you know. :)
I guess it all boils down to how many security issues and bugs you want to deal with. :/

Score: 0

|

lol you may need more than a flameproof suite.

Score: 0

|

LOL.

Yeah, you don't blame the product for users that ABUSE it, you blame the people USING!

Nice!

*Oh I forgot, Linux Sucks. Take that losers.*

: )

Score: 0

|

we aren't ashamed, it still sucks. It doesn't matter what you THINK we know about Linux, you WANT to use, go ahead, like you said.. freedom of choice.

There are WAY more people bashing Windows, for flaws in a world made up of people that have nothing better to do than to expose problems in software, when in reality we don't try to nail the hackers, we blame the products for not being able to defend every CONCEIVABLE problem. That's not even feasible.

We don't deal with problems, or security issues, we will with PEOPLE abusing PRODUCTS and trying to destroy their integrity.

So what, Linux doesn't list all these bugs, but they DO exist. The fan base is high enough to thwart the problem, because its up and coming, but Microsoft is a huge cash cow, so boo hoo, who cares of their product fails, they can afford it!

Yeah, whatever. EVERY product has security issues, and every day is a new security threat for Linux ALSO, just remember that.

Windows users don't bash Linux, its the other way around, GOT IT?

Score: 0

|

+1 for the OpenOffice toilet.

Score: 0

|

OK, so the reason I have never ever had a breach of security on my Linux machine doesn't mean anything? NO, it just means that there are very little security threats AND/OR that it is extremely hard to exploit those issue.

*Windows users don't bash Linux, its the other way around, GOT IT?*
Read above, I think you forgot what the person above you posted that you quoted, the door swings both ways. Concidering the fact that there are less Linux users and most Windows users are not aware of what Linux really is or ever heard of it. I will agree with you halfway on that.

Score: 0

|

I dual boot Win XP with SUSE Linux 10.1 bud. Pure Windows users don't bash Linux. I'm a hybrid.

For the record i've NEVER had a security breach on my wintel either. When I installed SUSE 10.1 the first day it came out I had 60 updates ready (and my damn updater service wouldn't work either!). Your argument is a waste - all software has flaws.

Get your fanboyism outta ur ass.

Score: 0

|

Open office users simply ignore the flame, and continue to use calc without any sec issues.

Score: 0

|

WTF difference does that make? *I* have NEVER had a security breach or virus or ANY "exposed" flaw on my Windows machine either. So what. Supposedly Windows is crap when it comes to security and flaws, but yet I haven't had *ANY* problems, so what does that prove? NOTHING.

I know that problems exist because PEOPLE allow them to happen. They are basically ignorant about how keep yourself from being exposed. Just like those stupid phishing emails, they only AFFECT you, if you ALLOW them to.

That could be considered a flaw of email, but only the stupid would actually click on them and give them personal info.

Linux having very little security threats is like saying that surface streets have very little traffic on holidays, its ALL relative. They have a SMALL-*ER* footprint, therefore a SMALL-*ER* threat, but its NOT non-existent. Let's get that straight right now.

The apparent threat is less, because the user base is less, the installation is less, the support is less, the development is less, the vendor base is less.. so what? As it grows, so will the threat. That's part of growth.

Kuwait sits right next to Iraq. Does it get bombed by US/Allied forces? NO. Why? Because it isn't a threat. Iraq may attack it, because its a very close, apparently "weak" nation, but that doesn't mean Kuwait is trouble free. They have crime, stealing, people that commit murders.. USA, we are a BIG country and we have a VERY large presence, again so what? We get every person from all over the world trying to get across our borders, because they "heard" this was the land of the free and opportunity. I don't know about you, but I have to work for a living, I can't quit.

So if this nation is so great why aren't we all enjoying a 7 figure bank account and earning 20%? Because its all PERCEPTION, that's why. Kuwait isn't a threat to other nations, because they are some small, insignificant country. USA on the other hand, well we have EVERY thing OTHER people want.. yet if we are SO perfect, why do people move to England, France, Canada? Because they WANT to.. it obviously WASN'T perfect for them was it?

Score: 0

|

Like Jordanr05 and rijp, I too NEVER had any security breach with my Windows. And I'm sure we are all heavy users.

The way I see it: 90% of computer users use Windows --> chances are, 90% of all dumb people in the world use Windows.

If you let dumb people use Linux, they'll probably just log in as root anyway.

.....and why are we talking about Windows vs Linux anyway? The article is about Excel - the most powerful spreadsheet on the planet. If you can't handle it, use something much less powerful. OO Calc comes to mind.

Score: 0

|

well said jordan.

i'm a hybrid too, XP and Ubuntu, and both work like a charm, and have never been exploited in any way.

Monoculture is bad, it has been proved. http://en.wikipedia.org/wiki/Monoculture

Score: 0

|

I like that quote, though...I may have to make some sort of .sig with it.

...imagine the flames I'd get on slashdot with a .sig like that....that'd be awesome. *grins*

Score: 0

|

As for OpenOffice, I make no comment since I don't use it, but the screenshots seem like it is nice.

Now, on the people who open Excel documents from unknown senders, if you aren't expecting an Excel document from someone you know, you shouldn't be opening it. Same goes for any files for that matter. This is about user education and I wish it were that simple.

The fact of the matter is the average user probably doesn't even know how they get infected and they don't realize it is from all the trash they open. Case in point, my younger siblings had 300+ adware, malware, spyware, trojans, keyloggers on their PC. Two weeks later there were 20 more after I cleaned it all out.

I guess you play with fire till you get burned. Some of us are just better at remembering that last time the guy next to me put his hand over the fire pit, he ended up in the ER with 3rd degree burns and couldn't surf porn on the net for weeks because he only had one hand and well, you kinda need two right?

Score: 0

|

Software has it's flaws, yes, but which operating system one uses? Honestly, why do people fight over this? It's all data anyway, binary, C, whatever, it's all the same. Using a different operating system from the conformist standards... So what? It simply looks and acts differently, but serves the same purpose.

And for you linux bashers out there, why not TRY it? It seems to me the only people with the right to talk smack about something, have used it before. Now why don't you just keep quiet, and let others live how they'd like. (Note for Windows bashers: Same goes for you.)

(I've had attempts to gain access with multiple OSes... Nothing really differs from each... Remember folks, it's all simply code. ^_-) -Dr. Keo

Score: 0

|

Bringing it back to the basic's, very nice.

Score: 0

|

so is that what your doing now? ignoring the flame? or making an attempted witty comeback in the guise of being better than the flamer?

Score: 0

|

i dont even know what the big deal is, i dont see how what operating system x uses is going to ever affect me in any way, shape, or form. ive never had a problem on my computer running windows, and ive never had a problem with my slackware install on my other computer, regardless of any vulns discovered. im not a dumb user so i have no problems.

Score: 0

|

Google Chrome 4: Yes, it's fast, but is it usable?

As Betanews readers have responded to our stories about Chrome's JavaScript superiority...Does that mean we'd actually use this browser? Well...

Video: Netflix on PlayStation 3

Netflix has come to the PlayStation 3 via Blu-ray and BD-Live.

Verizon Wireless launches new Android, Chocolate, and ruggedized phones

The lower-priced Eris joins the Droid, while the Chocolate gets a touchscreen and more music playback.

Early sales figures for Windows 7 nicely high, but do we know why?

Fans of triple-digit surges in figures quoted by Betanews will love this one, as it appears Microsoft rediscovered how to pull off a software launch.

Myka announces its latest Linux-based 'net top box'

Myka's ION brings Boxee, XMBC, and much more to HDTVs.

What hath Mac wrought? A remembrance after a quarter-century

The reason there's a Macintosh today is not because of some brilliant flash of engineering genius, but because Apple had the audacity to learn from its mistakes.

Early build of Moblin 2.1 improves connectivity, but not device support

The Linux Foundation's Atom-centric OS yesterday received a major overhaul with the project release of Moblin 2.1 for netbooks and nettops.

The iPhone's China syndrome: Sales of 5,000 and climbing

There's actually a country where Apple's device is not a godsend, where sales can be measured in the dozens.

New European counterpart to FCC will ensure 'a more neutral net'

Late Thursday night, the ruling telecom administrators of the EU's member nations signed away their final authority to a new entity overseen by the EC.

Sophos study suggests Windows 7 UAC's default setting is self-defeating

Without any anti-virus installed, a Sophos test showed, User Account Control was only capable of thwarting just one malware package out of ten samples chosen.

Indiscreet tweet trips awareness of Web SSL vulnerability

A group of high-level security engineers had been making progress on thwarting a low-level threat to the Web, until somebody blurted it all out on Twitter.