A
Alan
Microsoft Security Advisory (932553)
Vulnerability in Microsoft Office Could Allow Remote Code Execution
Published: February 2, 2007
Microsoft is investigating new public reports of very limited Microsoft
Excel "zero-day" attacks using a vulnerability in Microsoft Office 2000,
Microsoft Office XP, Microsoft Office 2003, and Microsoft Office 2004 for
Mac
In order for this attack to be carried out, a user must first open a
malicious Office file attached to an e-mail or otherwise provided to them by
an attacker.
While we are currently only aware that Excel is the current attack vector,
other Office applications are potentially vulnerable.
As a best practice, users should always exercise extreme caution when
opening unsolicited attachments from both known and unknown sources.
Microsoft has added detection to the Windows Live OneCare safety scanner for
up-to-date removal of malicious software that attempts to exploit this
vulnerability.
Microsoft intends to actively share information with Microsoft Security
Response Alliance partners so that their detection can be up to date to
detect and remove attacks.
Customers in the U.S. and Canada who believe they are affected can receive
technical support from Microsoft Product Support Services at 1-866-PCSAFETY.
There is no charge for support calls that are associated with security
updates.
International customers can receive support from their local Microsoft
subsidiaries. There is no charge for support that is associated with
security updates. For more information about how to contact Microsoft for
support issues, visit the International Support Web site.
Upon completion of this investigation, Microsoft will take the appropriate
action to help protect our customers. This may include providing a security
update through our monthly release process or providing an out-of-cycle
security update, depending on customer needs.........
http://www.microsoft.com/technet/security/advisory/932553.mspx
Alan
Vulnerability in Microsoft Office Could Allow Remote Code Execution
Published: February 2, 2007
Microsoft is investigating new public reports of very limited Microsoft
Excel "zero-day" attacks using a vulnerability in Microsoft Office 2000,
Microsoft Office XP, Microsoft Office 2003, and Microsoft Office 2004 for
Mac
In order for this attack to be carried out, a user must first open a
malicious Office file attached to an e-mail or otherwise provided to them by
an attacker.
While we are currently only aware that Excel is the current attack vector,
other Office applications are potentially vulnerable.
As a best practice, users should always exercise extreme caution when
opening unsolicited attachments from both known and unknown sources.
Microsoft has added detection to the Windows Live OneCare safety scanner for
up-to-date removal of malicious software that attempts to exploit this
vulnerability.
Microsoft intends to actively share information with Microsoft Security
Response Alliance partners so that their detection can be up to date to
detect and remove attacks.
Customers in the U.S. and Canada who believe they are affected can receive
technical support from Microsoft Product Support Services at 1-866-PCSAFETY.
There is no charge for support calls that are associated with security
updates.
International customers can receive support from their local Microsoft
subsidiaries. There is no charge for support that is associated with
security updates. For more information about how to contact Microsoft for
support issues, visit the International Support Web site.
Upon completion of this investigation, Microsoft will take the appropriate
action to help protect our customers. This may include providing a security
update through our monthly release process or providing an out-of-cycle
security update, depending on customer needs.........
http://www.microsoft.com/technet/security/advisory/932553.mspx
Alan