|
|
|
 |
Vulnerability Note VU#287067Microsoft PowerPoint and Excel fail to properly detect macros thereby automatically executing malicious code via crafted document (MS01-050)OverviewA malformed Microsoft Excel or PowerPoint document can bypass macro checking thereby allowing arbitrary code to be run on the target system.I. DescriptionMicrosoft Excel and PowerPoint scan documents when they are opened and check for the existence of macros. If the document contains macros, the user running Excel or PowerPoint is alerted and asked if they would like the macros to be run. Because Microsoft Excel and PowerPoint do not adequately detect macros, a user can unknowingly run macros containing malicious code when opening an Excel or PowerPoint document. There are several delivery mechanisms available to an intruder to execute this attack. The attacker could craft a specially formed Excel or PowerPoint document with macro code that would run automatically when the user opened it and send it via electronic mail to a victim or multiple victims. Alternatively, the attacker could host a specially formed Excel or PowerPoint document on a web site and offer it for download. Additionally, an attacker could deliver the malicious document via open file shares.According to the Microsoft Security Bulletin, the following versions of Excel and PowerPoint are affected:
Microsoft tested the following versions:
Versions of Excel and PowerPoint (or indeed, other products in the Office suite) prior to this may be affected, but are unsupported. For example, Symantec claims that Microsoft Office 97 and Microsoft Powerpoint 97 are vulnerable as well. Microsoft has not indicated whether or not Microsoft Excel 97 and Microsoft Powerpoint 97 are vulnerable. We are working with Microsoft to determine if these versions are indeed vulnerable as Symantec claims. Given the strong potential for widespread abuse of this problem, we strongly recommend that you apply patches as soon as you are able. A similar problem was responsible for the Melissa virus in March of 1999, for example. For more informaiton, see http://www.cert.org/advisories/CA-1999-04.html Additional information is available from http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS01-050.asp II. ImpactAn attacker could craft a specially formed Excel or PowerPoint document with macro code that would run automatically when the user opened it and send it via electronic mail to a victim or multiple victims. Alternatively, the attacker could host a specially formed Excel or PowerPoint document on a web site and offer it for download. Additionally, an attacker could deliver the malicious document via open file shares.III. SolutionApply a patch from your vendor.
Referenceshttp://www.cert.org/advisories/CA-1999-04.html
This document was written by Ian A. Finlay.
If you have feedback, comments, or additional information about this vulnerability, please send us
email. |
|||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||
Get Adobe Reader