Vulnerability Note VU#26493

If a spreadsheet contains a reference to an external macro (XLM) file, Excel does not generate the usual warning dialog asking if the user wants to run the macro. Microsoft reports that the macros can not be automatically executed, and that the user must trigger the macro. It is possible that actions such as changing the cell focus are sufficient to trigger a macro however. The file types that may include a reference to an external macro include: comma separated values, tab delimited text, and data interchange format. Excel 97 and Excel 2000 have this vulnerability.

Microsoft has published a security bulletin with additional information at:

http://www.microsoft.com/technet/security/bulletin/MS00-022.asp

Users may be tricked into executing an Excel macro, allowing the creator of the spreadsheet to execute arbitrary commands as the user opening the spreadsheet.

Apply a Patch

Microsoft has produced patches to correct this vulnerability. The patches are referenced in their advisory at:

http://www.microsoft.com/technet/security/bulletin/MS00-022.asp

Set Macro Security Level to"High"

Setting the macro execution security level to "High", will prevent the macros from running.