Slashdot Mirror
No Patch For Excel Zero-Day Flaw
CWmike writes "Microsoft said today that it will deliver three security updates on Tuesday, one of them marked 'critical,' but will not fix an Excel flaw that attackers are now exploiting. 'It doesn't look like we're going to see patches for any open Microsoft security advisories,' said Andrew Storms, director of security operations at nCircle Network Security, pointing to three that have not yet been closed. Those include two advisories issued last year — one from April 2008, another from December — and the Excel alert published last week. 'I'm not really surprised that the Excel vulnerability won't be patched, what with the timeline,' said Storms, 'but the others have been open for a long time.'"
I would be laughing if I didn't have to support MS Office users occasionally. Did they really have to announce that they weren't going to patch excel?
OK, you may disagree, but I've worked at banks and found that Excel use is widespread in mission critical applications, research, trading, and what not. Its like the swiss army knife for non-programmers engaged in decision making. They don't care about security issues (really, they wouldn't know if there was a security issue in any app until Legal departments tell them)
The philosophy for these situations is, 'if its not broken, don't fix it'. As long as Excel remains usable for corporate clients, upgrades and bug fixes will trickle is a slow rate.
FreeBSD bounties
So you receive a virus riddled Excel spreadsheet, open it, the virus infects your system, and what...your system runs as shitty as it always did, the uptime and stability go from crapsville to shitycity, the OS is still as sluggish as it's always been. I mean, hell, there's even a shot that the virus will make things a little better. At least maybe you'll get occassional porn popups from the system tray, and your IE home page will be redirected to an asian teen movie site. I'd say it's a net win.
According to Microsoft, they have a better track-record at fixing bugs faster than Linux.
Fair enough. On your way out don't let the door hit you where the lord split you.
And yet you continue to not only read it but to take the time to comment.
My russian friends can make zero day exploits all day long. It's good for the economy. Keeps you silly american busy. I love amerika robert halcombe rhalcom@sovgrp.com
Need a Russian bride? I have a large supply in a warehouse waiting for you. I offer a great trade-in plan too! Robert H
har har it's funny because it's like what you think Slashdot is like.
I've only seen the topic of this article maybe 4 times since it became an issue. Find a better example.
If you don't even know that corporations still use it, why would I trust your advice? You're obviously stupid.
I love Linux and Open Source, but posts like this really piss me off.
I have an excel spreadsheet that shows the history of such an exploit. Please open the following...
I wonder if any one has tested this exploit on Open Office Calc, Apple Numbers and other MS Office compatible applications?
As much as I don't like the idea of replacing Microsoft on the desktop with any Linux I gotta appreciate the name.
Big Buck Hunter Safari for the win! The original is too easy by comparison.
Ha! Skimming through the subject lines, I thought this post read "No Patch For Adobe Zero-Day Flaw".
Too late
Do you even lift?
These aren't the 'roids you're looking for.
Won't work as-is, and I've never heard of an exploit being successfully 'ported' to OO or whatever. XLS is like the other "classic" office formats basically just a serialised object memory dump, which is why it's such a horrific mess and full of vulnerabilities. However the vulnerabilities always seem to be overwrites dependent on the exact memory structure that the office parser produces, rather than generalised "whoops we passed user input to an exec()" type ones.
Can we stop using the term "zero-day"? It is supposed to refer to malware that is released the same day the exploit becomes public knowledge. At this point, the excel bug still may not be fixed, but its been a heck of a lot more than zero days since it was publicized...
I'm sorry but can someone tell me what the actual flaw in Excel is? The articles just talk about who found it, who is attacked, or not, but no concrete hint as to the nature of the problem.
In other words, what exactly is it the patch should change?
What? Just a CD, not a DVD?
Since OO is based on reverse engineering, it has a far more robust parser for the MS formats... Because they don't know what to expect, their parser is much better at handling unexpected data.. This is also why OO is often much better at opening damaged files.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
This just proves that being a monopoly allows you to ignore your users.
Excel is a major tool in many corporates, and having such an exploit can make havoc.
no the least, this shows that making your own rules can help you claim whatever you want - time to fix / number of vulnerabilities, etc.
Design to last - blog on system engineering
suck.com did one a few years ago called "suckdot", it was hilarious. Tux wearing a turban and wielding a scimitar was priceless! I wish I could find it.
There are two uncyclopedia articles about slashdot, there's slashdot.org, a parody of slashdot, and slashdot (country).
From the parody (formatted to look like slashdot):
From slashdot (country)
Free Martian Whores!