June 16, 2006 10:14 AM PDT

New Excel zero-day flaw used in attacks

A new, yet-to-be-patched security vulnerability in Microsoft's Excel has been exploited in at least one targeted cyberattack, experts warned on Friday.

A malicious Excel document is sent as an e-mail attachment or otherwise delivered by the attacker to the intended victim, Microsoft said in a posting to its Security Response Center blog. The Redmond, Wash., software maker said it has received one report from a customer who had been hit by such a problem.

"In order for this attack to be carried out, a user must first open a malicious Excel document," a Microsoft representative wrote. "So remember to be very careful opening unsolicited attachments from both known and unknown sources."

Samples of malicious Excel files called "okN.xls" have been found, Symantec said in an advisory. The malicious spreadsheet file contains a Trojan horse, called "Mdropper.J," and program called "Booli.A" that can download more malicious files to an infected PC, the security company said.

"Attackers are actively exploiting this vulnerability in targeted attacks," Symantec said. The issue appears to affect all versions of Excel, including Excel 2003 and Excel 2000. If the attempt is successful, the intruder will gain full control over the targeted computer, the company said.

Word of the outbreak and of the new flaw comes just days after Microsoft released 12 security bulletins with fixes for 21 vulnerabilities in several of its products, including Office. Some experts believe the timing of the new attack is no coincidence.

"In recent similar attacks, Microsoft has not issued an out-of-cycle patch," Scott Carpenter, director of Security Labs at Secure Elements, said in a statement. "The exploit's immediate release after 'Patch Tuesday' is evidently designed to take advantage of a full month before Microsoft is scheduled to patch it."

In addition, the monthly set of patches Microsoft released Tuesday included a fix for a Word flaw that had already been used in targeted cyberattacks. Instead of issuing an out-of-cycle patch, Microsoft recommended that users be careful in opening Word documents and that they run the application in safe mode.

Microsoft has not said whether it plans to release a fix for the new Excel flaw. The software maker said it has added detection capabilities to its Windows Live Safety Center for removal of malicious software that attempts to exploit the vulnerability.

See more CNET content tagged:
cyberattack, Microsoft Excel, attack, flaw, software company


Join the conversation!
Add your comment
excel zero day flaw
It seems to me( and I guess it's just me) that 30 days is too long to wait for a patch. Since Microsoft virtually owns the personal software market, can't they hire the best and brightest to solve these hacking problems say--Overnight?. Or, just go buy Symantec and have them do nothing but attack malicious code all day. Or is it a case of "there's money to be made here so let's not move too quickly". Of course, it would help if Microsoft were a software company and not a software MARKETING company.
Posted by whiner60 (1 comment )
Reply Link Flag
This is why I use Open Office
Unfortunatly, I know that people who work for me use Microsoft Office when working from home.
Posted by ralfthedog (1589 comments )
Reply Link Flag
This is why I use Mac OS X
I can use Excel 2004 for complete interoperability with every
version of Excel (Mac OS or Ms Windows) released since 1997, but I
dont have to worry about these stupid Windows-based flaws.
Posted by the Otter (247 comments )
Reply Link Flag
Common comment: "That's why I use 'Anything But Microsoft' products
For every Microsoft product there is a better alternative, it isn't just MS Office that is a threat to the Internet ecosystem.
Posted by 206538395198018178908092208948 (141 comments )
Reply Link Flag

Join the conversation

Add your comment

The posting of advertisements, profanity, or personal attacks is prohibited. Click here to review our Terms of Use.

What's Hot



RSS Feeds

Add headlines from CNET News to your homepage or feedreader.