No Patch For Excel Zero-Day Flaw 52
CWmike writes "Microsoft said today that it will deliver three security updates on Tuesday, one of them marked 'critical,' but will not fix an Excel flaw that attackers are now exploiting. 'It doesn't look like we're going to see patches for any open Microsoft security advisories,' said Andrew Storms, director of security operations at nCircle Network Security, pointing to three that have not yet been closed. Those include two advisories issued last year — one from April 2008, another from December — and the Excel alert published last week. 'I'm not really surprised that the Excel vulnerability won't be patched, what with the timeline,' said Storms, 'but the others have been open for a long time.'"
Re:quickly bash them... (Score:1, Informative)
Re:HAHAHAHHA (Score:3, Informative)
Re:But let's not forget... (Score:5, Informative)
I assume you were funny, but in case you were not:
Microsoft counts from the day they publicly confirm the existence of a bug.
Most others counts from the day the bug was publicly known.
So if Microsoft delay the confirmation of a publicly known bug, the numbers will work in their favour.
Re:Does this affect Open Office Calc & Apple N (Score:1, Informative)
Won't work as-is, and I've never heard of an exploit being successfully 'ported' to OO or whatever. XLS is like the other "classic" office formats basically just a serialised object memory dump, which is why it's such a horrific mess and full of vulnerabilities. However the vulnerabilities always seem to be overwrites dependent on the exact memory structure that the office parser produces, rather than generalised "whoops we passed user input to an exec()" type ones.