Slashdot Mirror
Zero-Day Excel Exploit In the Wild
snydeq writes "Microsoft Excel has a zero-day vulnerability that attackers are exploiting on the Internet, according to security vendor Symantec. The problem affects Excel 2007 both without and with Service Pack 1, according to an advisory on SecurityFocus, and other versions going back to Excel 2000. The program's vulnerability can be exploited if a user opens a maliciously crafted Excel file, allowing a hacker to leave a Trojan horse on the infected system."
An exploit? In my Microsoft product?
SAY IT AIN'T SO!!!
Well, let me just open this excel file detailing the financial agreement I will be making with Mr. Ugubu. Surely there is nothing wrong with opening attachments from untrusted sources.
I am not a *blank*, but I did stay at a Holiday Inn Express last night.
.... it was really protection to save you from trojans. Everybody knows that all trojans and exploits begin with the following code:
if (65535==65535) { install trojan; } else { don't install trojan; }
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.
Does it really count as zero-day if it's been a bug for 9 years?
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Excel\Security\FileOpenBlock]
"BinaryFiles"=dword:00000001
APK
Nope; that just plays Flight Simulator. ;-)
=Smidge=
Is it just my observation, or is eldavojohn an idiot?
1. Open up a new document. ...?
2. Press F5.
3. Type in x97:L97 in the reference box and press enter.
4. Press tab.
5. Hold down ctrl+shift.
6. While holding these two buttons click on the chart wizard button on the icon bar (the button looks like a bar graph).
7. Play the game while it secretly crafts a worm to take the extra money when transactions are rounded (only a few hundredths of a cent) and deposits them in an offshore account.
8.
9. PROFIT!
So that I can feel good about having it turned on for all apps.
Yes, and then break all compatibility with all current applications that are currently running on Windows.
Besides, Darwin is open source. MS could just use Darwin as the base and write a Windows compatible GUI on top of that.
While such a vector would be pretty useless on the public nets, just out of academic curiosity, I wonder: how fast would this critter would travel if it got loaded onto a SharePoint site (you know, one with the handy Excel-handling plugin turned on?)
Looking at it from the other end, how do you protect from such an eventuality without shutting off the plugin?
Quo usque tandem abutere, Nimbus, patientia nostra?
I don't really know how stable it's really considered, but I've had more application crashes on the latest kubuntu updated with kde 4.2 in a week of idle tinkering (apps from the default install, network manager, all kinds of things) than I have on vista 64 in several months of constant work.
The exploit is made of Tar?
Yes, and then break all compatibility with all current applications that are currently running on Windows.
That's an added advantage of such an approach. Bonus!
Zero day attack, exploitation of unpatched software vulnerabilities
It is the mark of an educated mind to be able to entertain a thought without accepting it.
With yet another incompatibility between OpenOffice and Excel, I really can't use OpenOffice.
The real "Libtards" are the Libertarians!
"That is only a workaround if you hate the guts of everybody who works the help desk." - by fuzzyfuzzyfungus (1223518) on Tuesday February 24, @03:33PM (#26974607)
I suggest you do a bit of reading here then from the URL below...
(Simply because, based on the data about this (straight from the horses' mouth @ MS)? There is a GOOD chance your networking folks will merge this on bootup logon scripts to protect you with it, @ this point so far @ least!)
Microsoft Security Advisory (968272)
Vulnerability in Microsoft Office Excel Could Allow Remote Code Execution
http://www.microsoft.com/technet/security/advisory/968272.mspx
----
SALIENT EXCERPT/QUOTE:
"Suggested Actions
Microsoft has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they help block known attack vectors. When a workaround reduces functionality, it is identified in the following section:
For Office 2003
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Excel\Security\FileOpenBlock]
"BinaryFiles"=dword:00000001
Note In order to use 'FileOpenBlock' with Office 2003, all of the latest Office 2003 security updates must be applied.
Impact of Workaround: Users who have configured the File Block policy and have not configured a special exempt directory as discussed in Microsoft Knowledge Base Article 922848 will be unable to open Office 2003 files or earlier versions in Office 2003 or 2007 Microsoft Office System.
For 2007 Office system
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Excel\Security\FileOpenBlock]
"BinaryFiles"=dword:00000001
Note In order to use 'FileOpenBlock' with the 2007 Microsoft Office system, all of the latest security updates for the 2007 Microsoft Office system must be applied.
Impact of Workaround: Users who have configured the File Block policy and have not configured a special exempt directory as discussed in Microsoft Knowledge Base Article 922848 will be unable to open Office 2003 files or earlier versions in Office 2003 or 2007 Microsoft Office System.
How to Undo the Workaround:
For Office 2003
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Excel\Security\FileOpenBlock]
"BinaryFiles"=dword:00000000
For 2007 Office system
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\12.0\Excel\Security\FileOpenBlock]
"BinaryFiles"=dword:00000000"
----
Especially since currently there is apparently NO other way to @ least protect yourself from this attack...
APK
P.S.=> The "adverse impacts" of this temporary work-around fix, IF any, are listed on said page also... apk
If it crashes your OS before you load Excel.
Well, there's still UAC if DEP fails to crash the OS :)
Reading plaintext unsafe. News at eleven.
Darwin is probably less portable and supports less hardware than, say, the BSDs or Linux. If I were MS I'd use FreeBSD (to avoid the GPL), and maybe take the old (BSD-licensed) version of Wine and patch it with bits of the original implementation of win32 to have some backward compatibility.
.NET (AFAIR called Rotor) that works under FreeBSD. Hm...
From what I've heard MS even has an open source (but non-free) implementation of
"It's worse than that Jim".
If used with the email worm on your less savvy coworker, it will infect HIM (her, or it) ... and really BE coming from your coworker.
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
Is this true? Any corroborating info from anyone?
Currently hooked on AMP
From what I've heard MS even has an open source (but non-free) implementation of .NET (AFAIR called Rotor) that works under FreeBSD. Hm...
That's here - it's unusual to see FreeBSD in requirements on Microsoft Downloads site :)
If I were MS I'd use FreeBSD (to avoid the GPL), and maybe take the old (BSD-licensed) version of Wine and patch it with bits of the original implementation of win32 to have some backward compatibility.
You don't know what you are talking about. Going to break binary compatibility for millions of applications (most of which are without sources)? That's a suicide for every company.
If you ever tried to change whatever API/ABI that has a lot of (external) client code - no matter, commercial or not, you'd understand how much woe it inflicts on your client developers. Even in opensource world, deprecated things (like libbonobo) hang around for long.
The main reason why Windows is so popular is because of its continuous binary compatibility spanning 10+ years.
Coding etudes
Ha! Without a doubt, the very best easter egg ever. I know they are considered bloat nowadays, but I always enjoyed them.
There is nothing so powerful as an idea whose time has come.
Agreed. It would be nice to see the day when Windows would no longer be able to run the viruses of yesteryear/yesterversion/[time period of your choosing].
Truly, breaking compatibility with current Windows stuff would be a plus.
Let q be a radix > 1. I am in ur base-q, killing 10 d00ds.
If MS can't make, a dramatically better OS, the question ultimately becomes when to they get out of the OS business.
Is a proprietary OS going to be the revenue generator for the future? Maybe, maybe not.
It sure looks like the future is spelled "small", as in eeePC, netbook, tabook, smartphone, MacBook Air & Similar devices, where the smooth running total system is what users want, and they don't want to fiddle with or debug the OS. That drives the average user nuts. Dell is starting to sell Linux installed and many other companies are doing so.
I'll use whatever I have to use to get my work done (including OSX & XP Pro right now), but given a choice I want a minimum hassle machine. I don't know if Win7 is going to be it, but comments and experience tells me probably not.
With a troublesome Win7 (Sheepskin over Vista), is MS going to just push customers to other OSs?
Once, long ago, Excel had a full flight simulator hidden in the code. Then Microsoft created the Flight Simulator team and it was one of their landmark "games".
Fast forward many years. Microsoft closed down Flight Simulator and a few days later there is a "several year old zero-day" exploit in, of all places, Excel.
Coincidence? I THINK NOT! Paybacks are a bitch, aren't they Mr. Ballmer?
Learning HOW to think is more important than learning WHAT to think.
We already can't open Office 2007 documents in Office 2003 so this just equalizes things.
Some people have jobs which require opening email attachments from unknown people. Secretaries are often the first point of contact for files sent by the general public. The secretary is often charged with opening the attached file(s) to make sure they're conformant in some organizational sense, then placing a copy of the file somewhere appropriate (such as a file server where other people can further vet the files).
I can easily see a situation where people are asked to upload files via a website to be opened by a committee later. Then everyone on the committee could be running on their machine with an administrative account (common for people who just bought a computer, sometimes having an admin account is viewed as a position of power and privilege).
I'm not saying that any of these problems can't be solved. I'm saying that to frame the issue as strange malcontents trying to take advantage of someone isn't addressing the complexity of the issue at hand.
It seems that this is just another area where overly-capable file formats, proprietary software, and programs that attempt to do too much are all coming together in an unpleasant way...again.
Digital Citizen
Not according to the article: "The program's vulnerability can be exploited if a user opens a maliciously crafted Excel file. Then, a hacker could run unauthorized code. Symantec has detected that the exploit can leave a Trojan horse on the infected system, which it calls "Trojan.Mdropper.AC."
That Trojan, which works on PCs running the Vista and XP operating systems, is capable of downloading other malware to the computer."
The report says: "Systems Affected: Windows Vista, Windows XP"
isn't there malware out there that can make it look like you are receiving an email from someone you know?
If so, this is not just a matter of being smart enough to not open attachments from strangers.
... I did list my source of information
Lemmy quote your initial post:
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Excel\Security\FileOpenBlock]
"BinaryFiles"=dword:00000001
APK
I'm done here. You can have the last word.
More and more the amount of work to run Windows is becoming less and less appealing.
OSx86, OS X, and Linux are getting very tempting
I'm safe - I'm still on Office 97
Yes. I thought that was obvious; certainly it was the entire point of my post. Perhaps I overestimated my audience... The idea was that every time anybody posts any kind of howto for modifying a Linux system which involves the issuing of terminal commands or editing values in /etc/somethingorother, some troll posts something along those lines explaining that such command-line shenanigans mean that Linux is not ready for the desktop, that it is necessary to design a system such that 'Grandma', whoever she may be, can set it up with a single click and needs never concern herself with such esoterica, and implies that some other system such as Windows meets these criteria. Hence I thought it amusing to echo those familiar posts now that it seems it is necessary to do the very same in Windows that we commonly do in Unix-like systems.
It seems I aimed too high. Irony's maybe a bit much for some people, I can see that, OK. Not to worry, I can dumb it down if you like. Knock Knock jokes, maybe?
Real Daleks don't climb stairs - they level the building.
Impressive list. So what have you been up to in the last ten years?
Real Daleks don't climb stairs - they level the building.
I also usually have at least 2 computers on hand, so if a virus makes the thing totally FUBAR, I can recover the files by using the non-FUBAR'ed computer to access the other's hard drive, then format the drive and reinstall windows/drivers/etc. from scratch.
Think about what you just wrote. /golfclap
Personally, I think friends should not let friends do Microsoft Windows. But that's just me.