A new, yet-to-be-patched security vulnerability in Microsoft's Excel has been exploited in at least one targeted cyberattack, experts warned on Friday.
A malicious Excel document is sent as an e-mail attachment or otherwise delivered by the attacker to the intended victim, Microsoft said in a posting to its Security Response Center blog. The Redmond, Wash., software maker said it has received one report from a customer who had been hit by such a problem.
"In order for this attack to be carried out, a user must first open a malicious Excel document," a Microsoft representative wrote. "So remember to be very careful opening unsolicited attachments from both known and unknown sources."
Samples of malicious Excel files called "okN.xls" have been found, Symantec said in an advisory. The malicious spreadsheet file contains a Trojan horse, called "Mdropper.J," and program called "Booli.A" that can download more malicious files to an infected PC, the security company said.
"Attackers are actively exploiting this vulnerability in targeted attacks," Symantec said. The issue appears to affect all versions of Excel, including Excel 2003 and Excel 2000. If the attempt is successful, the intruder will gain full control over the targeted computer, the company said.
"In recent similar attacks, Microsoft has not issued an out-of-cycle patch," Scott Carpenter, director of Security Labs at Secure Elements, said in a statement. "The exploit's immediate release after 'Patch Tuesday' is evidently designed to take advantage of a full month before Microsoft is scheduled to patch it."
In addition, the monthly set of patches Microsoft released Tuesday included a fix for a Word flaw that had already been used in targeted cyberattacks. Instead of issuing an out-of-cycle patch, Microsoft recommended that users be careful in opening Word documents and that they run the application in safe mode.
Microsoft has not said whether it plans to release a fix for the new Excel flaw. The software maker said it has added detection capabilities to its Windows Live Safety Center for removal of malicious software that attempts to exploit the vulnerability.
It seems to me( and I guess it's just me) that 30 days is too long to wait for a patch. Since Microsoft virtually owns the personal software market, can't they hire the best and brightest to solve these hacking problems say--Overnight?. Or, just go buy Symantec and have them do nothing but attack malicious code all day. Or is it a case of "there's money to be made here so let's not move too quickly". Of course, it would help if Microsoft were a software company and not a software MARKETING company.
I can use Excel 2004 for complete interoperability with every version of Excel (Mac OS or Ms Windows) released since 1997, but I dont have to worry about these stupid Windows-based flaws.
Google creates an animated doodle that features a boy, a girl, Google's search engine, and a jump rope. But might there be darker, more analytical, more troubling interpretations to this tale?
The Silicon Valley online payments startup grew by 1,000 percent last year and is hopeful it can repeat that level of growth this year. To do that, it's had to move away from its early friends-and-family roots and embrace small businesses.
Chamtech's spray-on antenna uses a nano material to provide a low-power boost to antenna range. The wireless-in-a-can product may some day bring an end to unsightly cell towers.
EnerG2 opens a plant to make an engineered carbon that will improve performance of energy storage devices and make storage for start-stop hybrid cars less expensive.
version of Excel (Mac OS or Ms Windows) released since 1997, but I
dont have to worry about these stupid Windows-based flaws.