Slashdot Mirror
Zero-Day Excel Exploit In the Wild
snydeq writes "Microsoft Excel has a zero-day vulnerability that attackers are exploiting on the Internet, according to security vendor Symantec. The problem affects Excel 2007 both without and with Service Pack 1, according to an advisory on SecurityFocus, and other versions going back to Excel 2000. The program's vulnerability can be exploited if a user opens a maliciously crafted Excel file, allowing a hacker to leave a Trojan horse on the infected system."
Well, let me just open this excel file detailing the financial agreement I will be making with Mr. Ugubu. Surely there is nothing wrong with opening attachments from untrusted sources.
I am not a *blank*, but I did stay at a Holiday Inn Express last night.
That is only a workaround if you hate the guts of everybody who works the help desk...
While such a vector would be pretty useless on the public nets, just out of academic curiosity, I wonder: how fast would this critter would travel if it got loaded onto a SharePoint site (you know, one with the handy Excel-handling plugin turned on?)
Looking at it from the other end, how do you protect from such an eventuality without shutting off the plugin?
Quo usque tandem abutere, Nimbus, patientia nostra?
I think it is the count of how much time Microsoft has been working on the bug.
Victims of 9/11: <3000. Traffic in the US: >30,000/y
With yet another incompatibility between OpenOffice and Excel, I really can't use OpenOffice.
The real "Libtards" are the Libertarians!
Zero-Day does not mean the day the bug was released. It means that it is a bug that is being exploited in the wild before a patch can be released. It doesn't matter when the bug was first coded. Compare that to a theoretical bug discovered by researchers that COULD be exploited, but isn't yet.
I normally wouldn't respond to an AC seemingly obvious misconception, but the fact that he was modded up means that people with mod points apparently don't have a clue, either...
My blog. Good stuff (when I remember to update it). Read it.
"That is only a workaround if you hate the guts of everybody who works the help desk." - by fuzzyfuzzyfungus (1223518) on Tuesday February 24, @03:33PM (#26974607)
I suggest you do a bit of reading here then from the URL below...
(Simply because, based on the data about this (straight from the horses' mouth @ MS)? There is a GOOD chance your networking folks will merge this on bootup logon scripts to protect you with it, @ this point so far @ least!)
Microsoft Security Advisory (968272)
Vulnerability in Microsoft Office Excel Could Allow Remote Code Execution
http://www.microsoft.com/technet/security/advisory/968272.mspx
----
SALIENT EXCERPT/QUOTE:
"Suggested Actions
Microsoft has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they help block known attack vectors. When a workaround reduces functionality, it is identified in the following section:
For Office 2003
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Excel\Security\FileOpenBlock]
"BinaryFiles"=dword:00000001
Note In order to use 'FileOpenBlock' with Office 2003, all of the latest Office 2003 security updates must be applied.
Impact of Workaround: Users who have configured the File Block policy and have not configured a special exempt directory as discussed in Microsoft Knowledge Base Article 922848 will be unable to open Office 2003 files or earlier versions in Office 2003 or 2007 Microsoft Office System.
For 2007 Office system
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Excel\Security\FileOpenBlock]
"BinaryFiles"=dword:00000001
Note In order to use 'FileOpenBlock' with the 2007 Microsoft Office system, all of the latest security updates for the 2007 Microsoft Office system must be applied.
Impact of Workaround: Users who have configured the File Block policy and have not configured a special exempt directory as discussed in Microsoft Knowledge Base Article 922848 will be unable to open Office 2003 files or earlier versions in Office 2003 or 2007 Microsoft Office System.
How to Undo the Workaround:
For Office 2003
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Excel\Security\FileOpenBlock]
"BinaryFiles"=dword:00000000
For 2007 Office system
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\12.0\Excel\Security\FileOpenBlock]
"BinaryFiles"=dword:00000000"
----
Especially since currently there is apparently NO other way to @ least protect yourself from this attack...
APK
P.S.=> The "adverse impacts" of this temporary work-around fix, IF any, are listed on said page also... apk
Welcome to slashdot!
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
Reading plaintext unsafe. News at eleven.
Once, long ago, Excel had a full flight simulator hidden in the code. Then Microsoft created the Flight Simulator team and it was one of their landmark "games".
Fast forward many years. Microsoft closed down Flight Simulator and a few days later there is a "several year old zero-day" exploit in, of all places, Excel.
Coincidence? I THINK NOT! Paybacks are a bitch, aren't they Mr. Ballmer?
Learning HOW to think is more important than learning WHAT to think.
Some people have jobs which require opening email attachments from unknown people. Secretaries are often the first point of contact for files sent by the general public. The secretary is often charged with opening the attached file(s) to make sure they're conformant in some organizational sense, then placing a copy of the file somewhere appropriate (such as a file server where other people can further vet the files).
I can easily see a situation where people are asked to upload files via a website to be opened by a committee later. Then everyone on the committee could be running on their machine with an administrative account (common for people who just bought a computer, sometimes having an admin account is viewed as a position of power and privilege).
I'm not saying that any of these problems can't be solved. I'm saying that to frame the issue as strange malcontents trying to take advantage of someone isn't addressing the complexity of the issue at hand.
It seems that this is just another area where overly-capable file formats, proprietary software, and programs that attempt to do too much are all coming together in an unpleasant way...again.
Digital Citizen