Old Excel paves way for targeted attacks
Connecting state and local government leaders
New and still-unpatched vulnerability exists in older versions of the spreadsheet program.
A recently unearthed and still-unpatched vulnerability in older versions of the Microsoft Office Excel spreadsheet program might be more trouble than initially expected, according to security experts.
"Overall, the risk is a little higher" than most people might realize, said James Shewmaker, who runs security consultant firm Bluenotch and works as an instructor for the SANS Institute. "Once more knowledge of the vulnerability gets out in the open this could be a pretty big problem pretty soon."
The vulnerability exists in Excel 2003 Service Pack 2, Excel Viewer 2003, Excel 2002, Excel 2000 and Excel 2004 for the Macintosh computer.
Newer versions of Excel, such as Excel 2007, Excel 2008 for Mac and even Excel 2003 with Service Pack 3 are not affected.
Microsoft has not issued a patch for the vulnerability, but indicated that it is working on one when it publicized the threat last week.
Even though this vulnerability affects only older versions of Excel, it could pose a major risk for federal agencies, as many still run older, often unpatched versions of the software, Shewmaker noted. And because Excel spreadsheets are so widely used, it is doubtful that they would be blocked altogether by organizations.
According to an advisory, Microsoft is investigating how the vulnerability may have been used to compromise customer systems, though the company has not released any details of the vulnerability itself.
Microsoft stressed that thus far the vulnerability has only been used in targeted attacks, attacks where someone has sent specially crafted content to a specific computer user in order to infiltrate that system. Customers who believe they've been attacked should contact Microsoft, the company said.
For the vulnerability to be used in an attack scenario, the victim must open an Excel document. If the user has administrative rights on that machine, the exploit would allow a remote user to then take over control of that computer. An infected Excel file could be sent by e-mail, or the user could also be lured, via an e-mail or instant message link, to an infected file on a Web site.
Microsoft warns users with these versions of Excel to not open Excel files (which may come with .xls, .xlt and .xla extensions) from untrusted sources. The company also recommends running files from unknown sources through the Microsoft Office Isolated Conversion Environment, which converts Office documents into the newer Microsoft Office formats, and could block malicious files in the process.
To exploit the vulnerability, the malicious party would create a malformed header in the document. The header information would corrupt system memory in a way that could allow a remote user to execute code on that machine.
If the user has full administrative privileges, the attacker could take full control of the computer. But even if the user only has user rights, that system could still be harnessed as a node in a botnet, said John Strand, a consultant with security engineering company Argotek, and an instructor for the SANS Institute as well.
Strand noted that this vulnerability is one of a growing number of zero-day attacks centered on Microsoft Office. Zero-day attacks are exploits that target vulnerabilities that have been made known before that software can be patched. The wording of the Microsoft advisory indicates that the company was made aware of this vulnerability from an outside source.
"We used to talk all the time about if zero-day exploits are happening, well now they are," Strand said. He added that even networks connected to the Internet could be at risk, as Office documents could be copied onto these networks by users.
NEXT STORY: Wyatt Kash | TSA: Lessons ignored