News
Excel Bug Prompts Microsoft Advisory
Reported vulnerability enables remote code execution
Microsoft is looking into public reports of a new-found vulnerability in its Microsoft Office Excel spreadsheet application that could enable a remote code execution attack by hackers. On Tuesday, Redmond issued an advisory outlining the problem.
Security solution provider Symantec Corp. claimed to have first discovered the Excel bug on Monday. Its researchers in an affiliate office in Japan found an unpatched vulnerability in Excel associated with the older .xls document format, according to a Symantec blog.
Symantec officials are calling the bug Trojan.Mdropper.AC. A malicious Excel file creates a Trojan-horse binary when the user opens the file. At the same time, a regular Excel document opens, masking the problem, according to the blog.
The technique isn't new, but the hackers added some tricks to cover the trail.
"We see this kind of behavior all the time, but as the analysis of the vulnerability progressed it became clear that this was a new vulnerability and the creators had used clever techniques to evade detection," said Vincent Weafer, vice president of Symantec Security Response, in an e-mailed comment. "The motivation behind this is not yet clear. As of yet, we have only seen a few targeted exploits of this vulnerability and continue to monitor for any signs of a widespread attack using this exploit."
In acknowledging the existence of the Excel problem, Microsoft said its advisory touches several Excel service pack versions in the 2000, 2002, 2003 and 2007 editions of the application. Excel Viewer is also affected, along with Excel 2004 and 2008 for Apple Inc.'s Mac.
"At this time, we are aware only of limited and targeted attacks that attempt to use this vulnerability," said Bill Sisk, senior program manager at Microsoft's Security Response Center in a statement issued on Tuesday. "We are developing a security update for Microsoft Office that addresses this vulnerability."
Sisk did not specify whether the patch would likely come in next month's slate or if it was merely for Excel or the whole Office suite of products.
-- Jabulani Leffall