Slashdot Mirror

← Back to Stories (view on slashdot.org)

No Patch For Excel Zero-Day Flaw

Posted by timothy on from the excel-lent dept.

CWmike writes "Microsoft said today that it will deliver three security updates on Tuesday, one of them marked 'critical,' but will not fix an Excel flaw that attackers are now exploiting. 'It doesn't look like we're going to see patches for any open Microsoft security advisories,' said Andrew Storms, director of security operations at nCircle Network Security, pointing to three that have not yet been closed. Those include two advisories issued last year — one from April 2008, another from December — and the Excel alert published last week. 'I'm not really surprised that the Excel vulnerability won't be patched, what with the timeline,' said Storms, 'but the others have been open for a long time.'"

4 of 52 comments (clear)

  1. The problem with excel: being mission critical by Slumdog · · Score: 5, Insightful

    OK, you may disagree, but I've worked at banks and found that Excel use is widespread in mission critical applications, research, trading, and what not. Its like the swiss army knife for non-programmers engaged in decision making. They don't care about security issues (really, they wouldn't know if there was a security issue in any app until Legal departments tell them)

    The philosophy for these situations is, 'if its not broken, don't fix it'. As long as Excel remains usable for corporate clients, upgrades and bug fixes will trickle is a slow rate.

    --
    FreeBSD bounties
    1. Re:The problem with excel: being mission critical by morgan_greywolf · · Score: 5, Insightful

      Yeah. Decision makers at banks have proved themselves to really intelligent lately, huh?

      --
      My blog
    2. Re:The problem with excel: being mission critical by mcgrew · · Score: 2, Insightful

      Considering how powerful spreadsheets (not just Excel) have been for decades, why would anyone open a spreadsheet from an untrusted source? Maybe I should RTFA, but this seems dumb.

      All of them I know of (am I out of date on this?) can open files, etc. Seems to ma a spreadsheet should do math and formatting -- and nothing else.

      Ironically, at work I get spreadsheets all the time; I have to convert between Lotus, Excel, and Quattro. I usually send a PDF as well, and more irony here; isn't there an Adobe vuln too?

      I use Star Office at home, but don't have the need for a spreadheet there. How does Star's spreadsheet fare?

      --
      Free Martian Whores!
  2. Re:How does this affect us? by Anonymous Coward · · Score: 1, Insightful

    If you don't even know that corporations still use it, why would I trust your advice? You're obviously stupid.

    I love Linux and Open Source, but posts like this really piss me off.