Slashdot Mirror
No Patch For Excel Zero-Day Flaw
CWmike writes "Microsoft said today that it will deliver three security updates on Tuesday, one of them marked 'critical,' but will not fix an Excel flaw that attackers are now exploiting. 'It doesn't look like we're going to see patches for any open Microsoft security advisories,' said Andrew Storms, director of security operations at nCircle Network Security, pointing to three that have not yet been closed. Those include two advisories issued last year — one from April 2008, another from December — and the Excel alert published last week. 'I'm not really surprised that the Excel vulnerability won't be patched, what with the timeline,' said Storms, 'but the others have been open for a long time.'"
I would be laughing if I didn't have to support MS Office users occasionally. Did they really have to announce that they weren't going to patch excel?
OK, you may disagree, but I've worked at banks and found that Excel use is widespread in mission critical applications, research, trading, and what not. Its like the swiss army knife for non-programmers engaged in decision making. They don't care about security issues (really, they wouldn't know if there was a security issue in any app until Legal departments tell them)
The philosophy for these situations is, 'if its not broken, don't fix it'. As long as Excel remains usable for corporate clients, upgrades and bug fixes will trickle is a slow rate.
FreeBSD bounties
So you receive a virus riddled Excel spreadsheet, open it, the virus infects your system, and what...your system runs as shitty as it always did, the uptime and stability go from crapsville to shitycity, the OS is still as sluggish as it's always been. I mean, hell, there's even a shot that the virus will make things a little better. At least maybe you'll get occassional porn popups from the system tray, and your IE home page will be redirected to an asian teen movie site. I'd say it's a net win.
Fair enough. On your way out don't let the door hit you where the lord split you.
According to Microsoft, they have a better track-record at fixing bugs faster than Linux.
Well, they seem to beat the hell out of OpenOffice.org, anyway. There's a bug in Calc that's been there for like...years now. OTOH, it's not a security bug, at least. ;)
My blog
My russian friends can make zero day exploits all day long. It's good for the economy. Keeps you silly american busy. I love amerika robert halcombe rhalcom@sovgrp.com
Need a Russian bride? I have a large supply in a warehouse waiting for you. I offer a great trade-in plan too! Robert H
If you don't even know that corporations still use it, why would I trust your advice? You're obviously stupid.
I love Linux and Open Source, but posts like this really piss me off.
I have an excel spreadsheet that shows the history of such an exploit. Please open the following...
I wonder if any one has tested this exploit on Open Office Calc, Apple Numbers and other MS Office compatible applications?
As much as I don't like the idea of replacing Microsoft on the desktop with any Linux I gotta appreciate the name.
Big Buck Hunter Safari for the win! The original is too easy by comparison.
Ha! Skimming through the subject lines, I thought this post read "No Patch For Adobe Zero-Day Flaw".
Too late
Do you even lift?
These aren't the 'roids you're looking for.
I assume you were funny, but in case you were not:
Microsoft counts from the day they publicly confirm the existence of a bug.
Most others counts from the day the bug was publicly known.
So if Microsoft delay the confirmation of a publicly known bug, the numbers will work in their favour.
Won't work as-is, and I've never heard of an exploit being successfully 'ported' to OO or whatever. XLS is like the other "classic" office formats basically just a serialised object memory dump, which is why it's such a horrific mess and full of vulnerabilities. However the vulnerabilities always seem to be overwrites dependent on the exact memory structure that the office parser produces, rather than generalised "whoops we passed user input to an exec()" type ones.
According to Microsoft, they have a better track-record at fixing bugs faster than Linux.
Well they would do. they use a different track.
It is difficult to get a man to understand something when his job depends on not understanding it.
Can we stop using the term "zero-day"? It is supposed to refer to malware that is released the same day the exploit becomes public knowledge. At this point, the excel bug still may not be fixed, but its been a heck of a lot more than zero days since it was publicized...
What? Just a CD, not a DVD?
There are bugs in MS products that have been there for years too, some of them are even security related...
Word had a bug since 97 whereby the macro function for counting lines ignored lines with bullet points on them, but when you came to insert to a particular line it counted bullet points and so would put stuff in the wrong place... They fixed it in 2007 with a security hotfix for word 2003 (wtf was a fix like this doing in a security hotfix?), but 2007 remained broken (may have been fixed by now, but i've not been forced to use it since then.
There is the SMB bug that was publicised recently, supposedly fixed a couple of months ago but the original bug was reported in 2001... This one was security related too!
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Since OO is based on reverse engineering, it has a far more robust parser for the MS formats... Because they don't know what to expect, their parser is much better at handling unexpected data.. This is also why OO is often much better at opening damaged files.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
This just proves that being a monopoly allows you to ignore your users.
Excel is a major tool in many corporates, and having such an exploit can make havoc.
no the least, this shows that making your own rules can help you claim whatever you want - time to fix / number of vulnerabilities, etc.
Design to last - blog on system engineering
suck.com did one a few years ago called "suckdot", it was hilarious. Tux wearing a turban and wielding a scimitar was priceless! I wish I could find it.
There are two uncyclopedia articles about slashdot, there's slashdot.org, a parody of slashdot, and slashdot (country).
From the parody (formatted to look like slashdot):
From slashdot (country)
Free Martian Whores!