Slashdot Mirror
Zero-Day Excel Exploit In the Wild
snydeq writes "Microsoft Excel has a zero-day vulnerability that attackers are exploiting on the Internet, according to security vendor Symantec. The problem affects Excel 2007 both without and with Service Pack 1, according to an advisory on SecurityFocus, and other versions going back to Excel 2000. The program's vulnerability can be exploited if a user opens a maliciously crafted Excel file, allowing a hacker to leave a Trojan horse on the infected system."
An exploit? In my Microsoft product?
SAY IT AIN'T SO!!!
Well, let me just open this excel file detailing the financial agreement I will be making with Mr. Ugubu. Surely there is nothing wrong with opening attachments from untrusted sources.
I am not a *blank*, but I did stay at a Holiday Inn Express last night.
.... it was really protection to save you from trojans. Everybody knows that all trojans and exploits begin with the following code:
if (65535==65535) { install trojan; } else { don't install trojan; }
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.
Does it really count as zero-day if it's been a bug for 9 years?
How is it a zero day two years after it was launched...
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Excel\Security\FileOpenBlock]
"BinaryFiles"=dword:00000001
APK
Nope; that just plays Flight Simulator. ;-)
=Smidge=
Is it just my observation, or is eldavojohn an idiot?
License Apple's OSX and layoff 30,000 people and just color the startup screen Vista Blue with the appropriate logo.
Then Microsoft will have to get busy making actual applications that WORK, consistently, easily & productively, on the NIXs & OSX.
I am a dreamer.
1. Open up a new document. ...?
2. Press F5.
3. Type in x97:L97 in the reference box and press enter.
4. Press tab.
5. Hold down ctrl+shift.
6. While holding these two buttons click on the chart wizard button on the icon bar (the button looks like a bar graph).
7. Play the game while it secretly crafts a worm to take the extra money when transactions are rounded (only a few hundredths of a cent) and deposits them in an offshore account.
8.
9. PROFIT!
So that I can feel good about having it turned on for all apps.
Superman 3?
While such a vector would be pretty useless on the public nets, just out of academic curiosity, I wonder: how fast would this critter would travel if it got loaded onto a SharePoint site (you know, one with the handy Excel-handling plugin turned on?)
Looking at it from the other end, how do you protect from such an eventuality without shutting off the plugin?
Quo usque tandem abutere, Nimbus, patientia nostra?
With yet another incompatibility between OpenOffice and Excel, I really can't use OpenOffice.
The real "Libtards" are the Libertarians!
DEP has a very slim chance of stopping this malicious excel file from installing the trojan - If it crashes your OS before you load Excel.
You can't attack me... I use MSDOS v6.11, lynx and the Crynwr network stack
How am I supposed to open my maliciously crafted Excel spreadsheets now???
"That is only a workaround if you hate the guts of everybody who works the help desk." - by fuzzyfuzzyfungus (1223518) on Tuesday February 24, @03:33PM (#26974607)
I suggest you do a bit of reading here then from the URL below...
(Simply because, based on the data about this (straight from the horses' mouth @ MS)? There is a GOOD chance your networking folks will merge this on bootup logon scripts to protect you with it, @ this point so far @ least!)
Microsoft Security Advisory (968272)
Vulnerability in Microsoft Office Excel Could Allow Remote Code Execution
http://www.microsoft.com/technet/security/advisory/968272.mspx
----
SALIENT EXCERPT/QUOTE:
"Suggested Actions
Microsoft has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they help block known attack vectors. When a workaround reduces functionality, it is identified in the following section:
For Office 2003
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Excel\Security\FileOpenBlock]
"BinaryFiles"=dword:00000001
Note In order to use 'FileOpenBlock' with Office 2003, all of the latest Office 2003 security updates must be applied.
Impact of Workaround: Users who have configured the File Block policy and have not configured a special exempt directory as discussed in Microsoft Knowledge Base Article 922848 will be unable to open Office 2003 files or earlier versions in Office 2003 or 2007 Microsoft Office System.
For 2007 Office system
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Excel\Security\FileOpenBlock]
"BinaryFiles"=dword:00000001
Note In order to use 'FileOpenBlock' with the 2007 Microsoft Office system, all of the latest security updates for the 2007 Microsoft Office system must be applied.
Impact of Workaround: Users who have configured the File Block policy and have not configured a special exempt directory as discussed in Microsoft Knowledge Base Article 922848 will be unable to open Office 2003 files or earlier versions in Office 2003 or 2007 Microsoft Office System.
How to Undo the Workaround:
For Office 2003
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Excel\Security\FileOpenBlock]
"BinaryFiles"=dword:00000000
For 2007 Office system
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\12.0\Excel\Security\FileOpenBlock]
"BinaryFiles"=dword:00000000"
----
Especially since currently there is apparently NO other way to @ least protect yourself from this attack...
APK
P.S.=> The "adverse impacts" of this temporary work-around fix, IF any, are listed on said page also... apk
If it crashes your OS before you load Excel.
Well, there's still UAC if DEP fails to crash the OS :)
Reading plaintext unsafe. News at eleven.
"It's worse than that Jim".
If used with the email worm on your less savvy coworker, it will infect HIM (her, or it) ... and really BE coming from your coworker.
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
Is this true? Any corroborating info from anyone?
Currently hooked on AMP
Anyone see, Vista is not affected by this?
Yes
Look, Vista is not affected by this bug... read that report!
Personally, we have just under 200 machines here and I do not have anti virus on a single one (our gateway does virus scanning on everything first)... I use group policy and set UAC toblock pretty much everything and we have not had a single problem since we deployed vista when it first came out.
People can laugh, People can say what they like, but I am a very happy system admin, and Vista has made my job so much easier.
Ha! Without a doubt, the very best easter egg ever. I know they are considered bloat nowadays, but I always enjoyed them.
There is nothing so powerful as an idea whose time has come.
where it says this and there is nothing below it:
Not Vulnerable:
Once, long ago, Excel had a full flight simulator hidden in the code. Then Microsoft created the Flight Simulator team and it was one of their landmark "games".
Fast forward many years. Microsoft closed down Flight Simulator and a few days later there is a "several year old zero-day" exploit in, of all places, Excel.
Coincidence? I THINK NOT! Paybacks are a bitch, aren't they Mr. Ballmer?
Learning HOW to think is more important than learning WHAT to think.
We already can't open Office 2007 documents in Office 2003 so this just equalizes things.
Some people have jobs which require opening email attachments from unknown people. Secretaries are often the first point of contact for files sent by the general public. The secretary is often charged with opening the attached file(s) to make sure they're conformant in some organizational sense, then placing a copy of the file somewhere appropriate (such as a file server where other people can further vet the files).
I can easily see a situation where people are asked to upload files via a website to be opened by a committee later. Then everyone on the committee could be running on their machine with an administrative account (common for people who just bought a computer, sometimes having an admin account is viewed as a position of power and privilege).
I'm not saying that any of these problems can't be solved. I'm saying that to frame the issue as strange malcontents trying to take advantage of someone isn't addressing the complexity of the issue at hand.
It seems that this is just another area where overly-capable file formats, proprietary software, and programs that attempt to do too much are all coming together in an unpleasant way...again.
Digital Citizen
isn't there malware out there that can make it look like you are receiving an email from someone you know?
If so, this is not just a matter of being smart enough to not open attachments from strangers.
"Thanks for not sourcing your information." - by ion.simon.c (1183967) on Wednesday February 25, @01:47AM (#26979291)
First of all, in response to your rather obvious sarcasm? See here:
http://it.slashdot.org/comments.pl?sid=1139485&cid=26975021
So - You're welcome: Because, in fact, I did list my source of information (Microsoft, "the horses' mouth", in this case)...
(AND, as anyone can see/verify? My detailed post PREDATES yours by nearly a FULL DAY, so NO EXCUSE EXISTS FOR YOUR BLATANT SKIMMING, period!)
SO, there you go - proof is in the pudding, that I did in fact source what I put out!
(Read a bit more, before shooting your mouth off again so quickly, ion.SIMIAN.c - Because, after all, this isn't the 1st time I've "made a monkey out of you", because of your skimming posts here... &, yes, I remember you (how could I forget "SIMIAN?")).
APK
P.S.=> Now, returned sarcasm aside: IF you take a peek @ that? The ONLY way to make this somewhat "bearable" will be to have that "exempt directory", & moving ALL of their users' EXCEL spreadsheets etc. to said exempted folder/directory (or, using MOICE) - but, @ least there IS a way imo, until MS issues a patch for Excel 2003 &/or 2007...
STILL - I hope that MS does an "out-of-band" patch for it instead of waiting until next "Patch Tuesday" next month, 3++ weeks away... apk
"Special File Exempt directory... hmmm what about the people who have Excel files in potentially hundreds of folders spread across many network servers? Ugh." -
Agreed, it's a pain somewhat, but... it's fairly EASY to implement once you gather all the files you use in Excel & place them into said folder + keep safe(r), vs. this exploit!
Here is an example of HOW to do it easily enough using regedit.exe (that works & I tested it), w/ this prebuilt template you can use (but, you WILL have to modify the "ExemptDirectory" string value's path to suit YOUR unique setup):
----
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Office]
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\11.0]
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\11.0\Common]
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\11.0\Common\OICEExemptions]
"ExemptDirectory"="C:\\Documents and Settings\\APK\\My Documents"
----
Copy & paste THAT to notepad.exe (what's between the dashed lines above),save it to disk, & THEN?
Open it in regedit.exe, to merge it...
E.G.-> My having done so here, yesterday?
Well - I'm once again able to open Excel sheets I created back in 1997 even... as well as current Office 2003 ones I use occasionally here (not a BIG Excel user usually anymore, though, on MY part).
IMPORTANT NOTE: Do please note, that I am using a LOCAL disk pathway, & that IF you have to use a UNC network path? I am NOT sure it will work here (that YOU have to test if you do this)...
HOWEVER - Simply keeping the SERVER service PATCHED (vs. other recently + past executed & exploiting machinations out there today that take advantage of holes in it, such as the recent server service RPC/Port 445 vulnerability) & active here, you can simply map network drives to use & assign them a driveletter & voila - SHOULD work, just as mine does here on LOCAL disks, just fine (for those that will have to use UNC paths OR mapped network drives as letters).
APK
P.S.=> OH, also? The Folder you edit into "ExemptDirectory" may be diff. than mine, but, it HAS to exist first, before you apply & try this...
(Common-sense, yes I know, but worth noting just in case)... apk
... I did list my source of information
Lemmy quote your initial post:
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Excel\Security\FileOpenBlock]
"BinaryFiles"=dword:00000001
APK
I'm done here. You can have the last word.
More and more the amount of work to run Windows is becoming less and less appealing.
OSx86, OS X, and Linux are getting very tempting
I'm safe - I'm still on Office 97
"I'm done here" - by ion.simon.c (1183967) on Wednesday February 25, @12:16PM (#26983505)
Damn right you are &, what proves it is you SKIMMED OVER where I did post a source in MS themselves no less & it predates where you stated I did not:
http://it.slashdot.org/comments.pl?sid=1139485&cid=26982097
THAT POST FROM ABOVE'S DATE-TIME STAMP? That IS the PROOF, from the URL above (WHERE I DO EXPLAIN THE DETAILS & SOURCES I USED, where you clearly stated I did not use a source)?
Well, once more?
It EASILY PREDATES YOUR SARCASTIC ATTACK OF MYSELF IN YOUR POST where you stated I did NOT post a source, &, BY A FULL DAY PRIOR TO YOUR PUNY ATTACK, IN THE URL ABOVE!
Do yourself a favor next time, & read ALL of the posts in an exchange, prior to firing your mouth off due to skimming over where I did indeed post a VALID source, in this very exchange...
So much for your usual sarcastic contributing nothing CRAP... vs., my post also being "modded up" +5 points, as informative (from this very exchange & topic, no less)...
APK
"The average end-user doesn't want to have to open registry editors and manually modify esoteric values in obscure text configuration files" - by meringuoid (568297) on Wednesday February 25, @09:24AM (#26981379)
YOUR "NITPICK" also goes for *NIX variants (& editing their config files in say, etc , usr/home, OR other folders/directories - subfolders/subdirectories) like Linux, Solaris, BSD variants like MacOS X & FreeBSD etc. et al... period.
Not all files are provided GUI front to their settings by native OS features &/or tools... especially GUI ones 'wizardy' 1 point click ones, in ALL cases, in ANY OS. Sometimes, you actually have to even use a std. text editor or tools like regedit.exe to get things done is all.
APK
P.S.=> ALSO DO NOTE - I made it the EASIEST I possibly could (& later even moreso), by explaining the details of HOW to save these into a .reg file, & using regedit.exe to "MERGE" them, as I did here for the REST of this fix:
http://it.slashdot.org/comments.pl?sid=1139485&cid=26983333
This being /., I'd figured YOU "/. techno jocks" was who I was addressing (& most of you imo? You're mostly NOT just 'wannabes' in this art & science is all) would appreciate that & understand HOW this is done is all... because I don't consider MOST of you 'noobz', I posted what I felt you could all EASILY digest, & use... apk
Yes. I thought that was obvious; certainly it was the entire point of my post. Perhaps I overestimated my audience... The idea was that every time anybody posts any kind of howto for modifying a Linux system which involves the issuing of terminal commands or editing values in /etc/somethingorother, some troll posts something along those lines explaining that such command-line shenanigans mean that Linux is not ready for the desktop, that it is necessary to design a system such that 'Grandma', whoever she may be, can set it up with a single click and needs never concern herself with such esoterica, and implies that some other system such as Windows meets these criteria. Hence I thought it amusing to echo those familiar posts now that it seems it is necessary to do the very same in Windows that we commonly do in Unix-like systems.
It seems I aimed too high. Irony's maybe a bit much for some people, I can see that, OK. Not to worry, I can dumb it down if you like. Knock Knock jokes, maybe?
Real Daleks don't climb stairs - they level the building.
"Perhaps I overestimated my audience.. Not to worry, I can dumb it down if you like." -
Well, ok... more sarcasm being directed my way: FINE!
Let's use some facts then, so you know you are not 'overestimating' your audience here, in myself!
Now, I get the feeling you're trying to "get my goat" here with this line of double-talk b.s. & trying to say "you were just being sarcastic".
Well - To that, I can only say this ->
The day your work has appeared in this many publications (respected ones in this field too in many a case here) over the last 13++ yrs now in this field:
----
Windows NT Magazine (now Windows IT Pro) April 1997 "BACK OFFICE PERFORMANCE" issue
http://journals2.iranscience.net:800/www.win2000mag.com/www.win2000mag.com/Windows/Article/ArticleID/37/37.html
(&, for work done for EEC Systems/SuperSpeed.com on PAID CONTRACT (writing portions of their SuperCache program increasing its performance by up to 40% via my work) albeit, for their SuperDisk & HOW TO APPLY IT, took them to a finalist position @ MS Tech Ed, two years in a row).
WINDOWS MAGAZINE, 1997, "Top Freeware & Shareware of the Year" issue page 210, #1/first entry in fact (my work is there)
PC-WELT FEB 1998 - page 84, again, my work is featured there
PC-WELT FEB 1999 - page 83, again, my work is featured there
CHIP Magazine 7/99 - page 100, my work is there
WINDOWS MAGAZINE, WINTER 1998 - page 92, insert section, MUST HAVE WARES, my work is again, there
GERMAN PC BOOK, Data Becker publisher "PC Aufrusten und Repairen" my work is contained in it
HOT SHAREWARE Numero 46 issue, pg. 54 (PC ware mag from Spain), my work is there, first one featured, yet again!
----
Well, that'd be the day you can try to "lord it over me", like you are "my superior" in this art & science... deal?
APK
Impressive list. So what have you been up to in the last ten years?
Real Daleks don't climb stairs - they level the building.
"Impressive list." - by meringuoid (568297) on Wednesday February 25, @08:46PM (#26991655)
WELL...
As "far as my list being impressive" as you said (&, that's only a PARTIAL list, there are others later from 2002-2004, some British PC mags iirc)?
I figure, that it is PRETTY "OK" - but, no more than that (however, NO less, as well!)
(Just more than MOST folks I encounter online who try to give me guff is all, & thus, I employ it that way, when necessary!)
Sure, & there are guys here (like one of your HIGHLY esteemed members in John Carmack for example) that BLOW MY DOORS OFF, as far as accomplishments & know-how in this field... &, he does, bigtime.
I can concede that... freely!
(As Mr. C. is someone I admire for his talents & works, of course, but MORE for things he has come up with in a UNIQUE way, such as "Carmack's Reverse", because to me, that is demonstrative of being able to THINK, more than anything!)
----
"So what have you been up to in the last ten years?" - by meringuoid (568297) on Wednesday February 25, @08:46PM (#26991655)
Making a couple more publications in shareware around 2002-2003 (some British PC mag I saw with my work in it @ BORDERS books), & then, I pretty much "dropped out" of that scene (shareware/freeware), once my apps were finalized + "bulletproof & bugfree" circa 2003 & afterwards?
Enjoying life, a LOT more! Some of those apps in that PARTIAL list I gave you paid off very well, w/ 2 becoming parts of commercially sold wares.
I say that, because I feel that shareware/freeware development's really the province of younger folks, with more time, energy, AND more to prove really.
(1 thing folks don't realize is, yes, shareware/freeware apps generally are like 10,000 (or less) lines of handwritten code in length via RAD tools @ least... & sure, MIS/IS/IT apps (especially 'enterprise class' ones, of which I have 25 to my credit @ this point after 16++ yrs. or so as a pro in this field)?
THOSE weigh in @ the MILLIONS of lines of code mark many times & many "moving parts" external to the .exe's codebase (such as stored procedures, DB side, for example).
HOWEVER - shareware/freeware has a FAR larger userbase, with a FAR larger mix of permutations of possible software + HARDWARE mixes to contend with, where in "KORPORATE AMERIKA", you USUALLY have a UNIFORM hardware + software mix, established by CIO & crew (which DOES create "less b.s." to deal with vs. shareware/freeware & its nearly UNLIMITED mixture of the permutations of both, thereof).
SO - in any event? I've just generally been working in this field, as per usual the last 16++ yrs. now as a pro in it, &, apparently?
One HELL of a LOT more than yourself in this field that was recognized by the trade rags that report on this field!
APK
P.S.=> So - how do YOU like MY closing bit of "sarcasm & irony" as YOU called it, albeit, directed YOUR way now, in return?
(It's not very nice is it??)
Sorry to use a dirty little trick like "reverse psychology" on you, but, it appears it made you cut off some of your sarcasm @ this point, hopefully... you don't need to waste time on that, nor do I! apk
I also usually have at least 2 computers on hand, so if a virus makes the thing totally FUBAR, I can recover the files by using the non-FUBAR'ed computer to access the other's hard drive, then format the drive and reinstall windows/drivers/etc. from scratch.
Think about what you just wrote. /golfclap
Personally, I think friends should not let friends do Microsoft Windows. But that's just me.
http://www.microsoft.com/technet/security/advisory/968272.mspx
Create the "BinaryFiles" entry, using this template (copy the contents of what's between these dashed lines into notepad.exe, save it to disk w/ a .reg extension, to open it in regedit.exe later for "merging")
----
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Excel\Security\FileOpenBlock]
"BinaryFiles"=dword:00000001
----
This will stop EXCEL from working though, so you need to do just a wee bit more, like so (creating an exempt folder, from w/in which you CAN run .xls files again):
-----
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Office]
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\11.0]
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\11.0\Common]
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\11.0\Common\OICEExemptions]
"ExemptDirectory"="C:\\Documents and Settings\\APK\\My Documents"
----
Again - Copy & paste THAT to notepad.exe (what's between the dashed lines above),save it to disk, & THEN?
Open it in regedit.exe, to merge it...
E.G.-> My having done so here, yesterday?
Well - I'm once again able to open Excel sheets I created back in 1997 even... as well as current Office 2003 ones I use occasionally here (not a BIG Excel user usually anymore, though, on MY part).
IMPORTANT NOTE: Do please note, that I am using a LOCAL disk pathway, & that IF you have to use a UNC network path? I am NOT sure it will work here (that YOU have to test if you do this)...
HOWEVER - Simply keeping the SERVER service PATCHED (vs. other recently + past executed & exploiting machinations out there today that take advantage of holes in it, such as the recent server service RPC/Port 445 vulnerability) & active, you can simply map network drives to use & assign them a driveletter & voila - SHOULD work, just as mine does here on LOCAL disks, just fine (for those that will have to use UNC paths OR mapped network drives as letters).
APK
P.S.=> OH, also? The Folder you edit into "ExemptDirectory" may be diff. than mine, but, it HAS to exist first, before you apply & try this...
(Common-sense, yes I know, but worth noting just in case)... apk