Slashdot Log In
Zero-Day Excel Exploit In the Wild
Posted by
kdawson
on Tue Feb 24, 2009 03:13 PM
from the be-careful-out-there dept.
from the be-careful-out-there dept.
snydeq writes "Microsoft Excel has a zero-day vulnerability that attackers are exploiting on the Internet, according to security vendor Symantec. The problem affects Excel 2007 both without and with Service Pack 1, according to an advisory on SecurityFocus, and other versions going back to Excel 2000. The program's vulnerability can be exploited if a user opens a maliciously crafted Excel file, allowing a hacker to leave a Trojan horse on the infected system."
Related Stories
[+]
No Patch For Excel Zero-Day Flaw 52 comments
CWmike writes "Microsoft said today that it will deliver three security updates on Tuesday, one of them marked 'critical,' but will not fix an Excel flaw that attackers are now exploiting. 'It doesn't look like we're going to see patches for any open Microsoft security advisories,' said Andrew Storms, director of security operations at nCircle Network Security, pointing to three that have not yet been closed. Those include two advisories issued last year — one from April 2008, another from December — and the Excel alert published last week. 'I'm not really surprised that the Excel vulnerability won't be patched, what with the timeline,' said Storms, 'but the others have been open for a long time.'"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
An Exploit (Score:2, Funny)
An exploit? In my Microsoft product?
SAY IT AIN'T SO!!!
Random E-mails (Score:5, Funny)
Re:Random E-mails (Score:5, Funny)
What do you mean "untrusted." He just sent me an email detailing how he is the caretaker of the Nigerian's former king's fortune. It sounds official too.
Parent
Re:Random E-mails (Score:4, Funny)
No kidding. I got an email a few weeks ago from Kofi Annan that talked about how he and some "big wigs at the UN" (his words, not mine) were looking for ways to split up some money, and he was wondering if I would be interested in receiving a share. I've heard of Kofi Annan and know that he was associated with the UN at one point, so it doesn't get any more official sounding than that.
Parent
Re: (Score:2)
...and I got one from a Barrister in Great Britain...
At least they're grammar and structure is get better. [sic]
Re: (Score:2)
Re:Random E-mails (Score:5, Insightful)
The real danger is in opening attachments from trusted sources. If this is used with an email worm, it will look like it is coming from your friends, coworkers, or any of your eight bosses. As a high priority, due yesterday, mission-critical action-item.
Parent
Re:Trusted (Score:2)
"It's worse than that Jim".
If used with the email worm on your less savvy coworker, it will infect HIM (her, or it) ... and really BE coming from your coworker.
Funny, but that won't help solve the problem. (Score:4, Interesting)
Some people have jobs which require opening email attachments from unknown people. Secretaries are often the first point of contact for files sent by the general public. The secretary is often charged with opening the attached file(s) to make sure they're conformant in some organizational sense, then placing a copy of the file somewhere appropriate (such as a file server where other people can further vet the files).
I can easily see a situation where people are asked to upload files via a website to be opened by a committee later. Then everyone on the committee could be running on their machine with an administrative account (common for people who just bought a computer, sometimes having an admin account is viewed as a position of power and privilege).
I'm not saying that any of these problems can't be solved. I'm saying that to frame the issue as strange malcontents trying to take advantage of someone isn't addressing the complexity of the issue at hand.
It seems that this is just another area where overly-capable file formats, proprietary software, and programs that attempt to do too much are all coming together in an unpleasant way...again.
Parent
Re:Random E-mails (Score:5, Insightful)
I was just thinking that - it's 2009. Who is still opening DOC or XLS attachments?
Umm... practically any company that does business with any municipal or state governmental agencies, law firms, accounting firms, etc etc. The question is who isn't opening DOC or XLS attachments from their clients, and how do they plan to stay in business?
Parent
and you thought that math "error" was a mistake... (Score:2)
.... it was really protection to save you from trojans. Everybody knows that all trojans and exploits begin with the following code:
if (65535==65535) { install trojan; } else { don't install trojan; }
Re: (Score:2)
A work-around for it... apk (Score:2, Interesting)
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Excel\Security\FileOpenBlock]
"BinaryFiles"=dword:00000001
APK
Re:A work-around for it... apk (Score:4, Insightful)
Parent
According to MS? It IS a work-around for this (Score:5, Informative)
"That is only a workaround if you hate the guts of everybody who works the help desk." - by fuzzyfuzzyfungus (1223518) on Tuesday February 24, @03:33PM (#26974607)
I suggest you do a bit of reading here then from the URL below...
(Simply because, based on the data about this (straight from the horses' mouth @ MS)? There is a GOOD chance your networking folks will merge this on bootup logon scripts to protect you with it, @ this point so far @ least!)
Microsoft Security Advisory (968272)
Vulnerability in Microsoft Office Excel Could Allow Remote Code Execution
http://www.microsoft.com/technet/security/advisory/968272.mspx [microsoft.com]
----
SALIENT EXCERPT/QUOTE:
"Suggested Actions
Microsoft has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they help block known attack vectors. When a workaround reduces functionality, it is identified in the following section:
For Office 2003
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Excel\Security\FileOpenBlock]
"BinaryFiles"=dword:00000001
Note In order to use 'FileOpenBlock' with Office 2003, all of the latest Office 2003 security updates must be applied.
Impact of Workaround: Users who have configured the File Block policy and have not configured a special exempt directory as discussed in Microsoft Knowledge Base Article 922848 will be unable to open Office 2003 files or earlier versions in Office 2003 or 2007 Microsoft Office System.
For 2007 Office system
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Excel\Security\FileOpenBlock]
"BinaryFiles"=dword:00000001
Note In order to use 'FileOpenBlock' with the 2007 Microsoft Office system, all of the latest security updates for the 2007 Microsoft Office system must be applied.
Impact of Workaround: Users who have configured the File Block policy and have not configured a special exempt directory as discussed in Microsoft Knowledge Base Article 922848 will be unable to open Office 2003 files or earlier versions in Office 2003 or 2007 Microsoft Office System.
How to Undo the Workaround:
For Office 2003
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Excel\Security\FileOpenBlock]
"BinaryFiles"=dword:00000000
For 2007 Office system
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\12.0\Excel\Security\FileOpenBlock]
"BinaryFiles"=dword:00000000"
----
Especially since currently there is apparently NO other way to @ least protect yourself from this attack...
APK
P.S.=> The "adverse impacts" of this temporary work-around fix, IF any, are listed on said page also... apk
Parent
Re:According to MS? It IS a work-around for this (Score:4, Insightful)
That isn't going to go over well. At all.
Parent
what's the big deal? (Score:2)
We already can't open Office 2007 documents in Office 2003 so this just equalizes things.
Re: (Score:3, Informative)
I say that, simply because, @ least in the workplace, where folks use Excel spreadsheets for daily accounting purposes (& other uses too)? It's NOT going to "go over well" @ all- Especially since I am certain those people will probably NEED to access said spreadsheets to some degree (in the timeframe it takes MS to make up a binary patch for Excel)
*ahem*
1: Excel 2007 has seperate file types for "yes macro XML", "no macro XML", and "old crappy binary" formats. .xlsx, .xlsm, and .xls, respectively. The first, .xlsx, is immune to trojan hacks the same way a .txt file in notepad is immune to them.
2: Excel 2003 has a COMPLETELY FREE UPDATE that lets it write and read .xlsx files.
3: Anyone who isn't using 2007 or 2003 can use OpenOffice, which, again, is highly resistant (immune?) to this bug. And can save to .xlsx.
Anyone using Excel probably needs it--
Re: (Score:2)
Re: (Score:2)
And what, pray tell, will the people who need to open .xls files sent to them by others, or previously created, do?
Open Office?
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
Any chance DEP stops this? (Score:2)
Re: (Score:2)
If it crashes your OS before you load Excel.
Well, there's still UAC if DEP fails to crash the OS :)
And what about SharePoint? (Score:4, Interesting)
While such a vector would be pretty useless on the public nets, just out of academic curiosity, I wonder: how fast would this critter would travel if it got loaded onto a SharePoint site (you know, one with the handy Excel-handling plugin turned on?)
Looking at it from the other end, how do you protect from such an eventuality without shutting off the plugin?
Re: (Score:2)
Looking at it from the other end, how do you protect from such an eventuality without shutting off the plugin?
Same way you protect the client -- disable .xls binary files.
OTOH, Sharepoint's Excel Web Services is a bitch to get anything to run, even when you're trying to. If you're using SharePoint in lieu of client-side Excel, it should effectively immuninize you from this bug, same as if you used OpenOffice on the client.
Another reason I can't use OpenOffice ..... (Score:5, Funny)
Next up: Zero-day Notepad exploit found (Score:5, Funny)
MS Vista becoming more secure? (Score:3, Interesting)
Is this true? Any corroborating info from anyone?
Re: (Score:2)
I never have issues with Vista. Of course, I'm also smart & knowledgeable enough not to open suspicious files or file attachments, run Avast! Antivirus, Spybot S&D, and Spybot's add-on program Teatimer (a handy thing that allows you to approve or deny any registry changes that occur at any time, during either installations or accidental visits to malicious websites that do things like change your registry entries to modify your "home page" to direct you to their site).
I also usually have at least 2
Re: (Score:2)
Just edit the article and add a [citation needed] tag; I'm sure someone will add the evidence.
What? Oh. Nevermind.
Re: (Score:3, Insightful)
Saying you've never had a virus without ever scanning your PCs is like saying you've never had an STD without ever getting tested. In both cases, you can have infections without symptoms, and the infections can be transmitted. Yes, there are false negatives, but that's no excuse to abstain from testing.
Granted, you said "never had a problem," not "never had a virus," but what you really meant was that you've never seen a problem. Considering that most malware these days is designed to run unnoticed rathe
Coincidence? (Score:5, Funny)
Once, long ago, Excel had a full flight simulator hidden in the code. Then Microsoft created the Flight Simulator team and it was one of their landmark "games".
Fast forward many years. Microsoft closed down Flight Simulator and a few days later there is a "several year old zero-day" exploit in, of all places, Excel.
Coincidence? I THINK NOT! Paybacks are a bitch, aren't they Mr. Ballmer?
Re: (Score:2)
Once, long ago, Excel had a full flight simulator hidden in the code. Then Microsoft created the Flight Simulator team and it was one of their landmark "games".
Taking a trip in the time machine, this would disprove the assertion that there are no games for the Mac! ;-)
Re: (Score:3, Informative)
Yes, and then break all compatibility with all current applications that are currently running on Windows.
Besides, Darwin is open source. MS could just use Darwin as the base and write a Windows compatible GUI on top of that.
Re: (Score:3, Insightful)
Yes, and then break all compatibility with all current applications that are currently running on Windows.
That's an added advantage of such an approach. Bonus!
Re: (Score:2)
From what I've heard MS even has an open source (but non-free) implementation of
Re: (Score:2)
If MS can't make, a dramatically better OS, the question ultimately becomes when to they get out of the OS business.
Is a proprietary OS going to be the revenue generator for the future? Maybe, maybe not.
It sure looks like the future is spelled "small", as in eeePC, netbook, tabook, smartphone, MacBook Air & Similar devices, where the smooth running total system is what users want, and they don't want to fiddle with or debug the OS. That drives the average user nuts. Dell is starting to sell Linux ins
Re: (Score:2)
Play the game while it secretly crafts a worm to take the extra money when transactions are rounded (only a few hundredths of a cent) and deposits them in an offshore account.
Be careful. Such games have been known to take a few hundredths of a billion and upgrade the crime from white collar resort prison to pound-me-in-the-ass prison ;)
Re: (Score:2)
The exploit is made of Tar?
Re:zero day? (Score:5, Funny)
I think it is the count of how much time Microsoft has been working on the bug.
Parent
Re:zero day? (Score:5, Informative)
I normally wouldn't respond to an AC seemingly obvious misconception, but the fact that he was modded up means that people with mod points apparently don't have a clue, either...
Parent
Re:zero day? (Score:5, Informative)
Welcome to slashdot!
Parent
Re: (Score:3, Funny)
Re: (Score:2)
Re: (Score:2)
Back in the day it was common to give really funny comments an underrated/informative/interesting mod because the 'funny' mod didn't give you karma. There are still one or two guys from that era around...
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Not according to the article: "The program's vulnerability can be exploited if a user opens a maliciously crafted Excel file. Then, a hacker could run unauthorized code. Symantec has detected that the exploit can leave a Trojan horse on the infected system, which it calls "Trojan.Mdropper.AC."
That Trojan, which works on PCs running the Vista and XP operating systems, is capable of downloading other malware to the computer."
The report says: "Systems Affected: Windows Vista, Windows XP"