Another Zero-Day Vulnerability Hits Office

Published: February 7, 2007

by Alex Woodie

Another zero-day vulnerability in Office--the fifth since mid-December--has been discovered in Excel that could enable hackers to take complete control of affected Windows and Mac PCs. Attacks are underway, although they're not widespread. Microsoft says it's working on a patch.

Microsoft's Security Response Center says the security flaw is present in Office 2000, Office XP, Office 2003, and Office 2004 for Mac. To exploit the flaw, a victim must first be tricked into opening an infected file, sent via e-mail or downloaded off the Web. Currently, Excel seems to be the only way this flaw is being exploited, although Microsoft warns there could be other avenues of attack.

Hackers are using the flaw to install Trojans that give them a backdoor into victims' computers, says antivirus software vendor McAfee. Currently, malware exploiting the flaw, called Exploit-MSExcel.h, poses a low security risk, the vendor says.

This is the fifth zero-day exploit discovered in the last six weeks. According to eEye Digital Security's new Zero-Day Tracker, there are currently nine zero-day vulnerabilities that have yet to be patched by the vendor. All nine involve Microsoft products; four target MS-Word, three target Windows, one targets Internet Explorer, and one targets PowerPoint.

For more information on the new Excel zero-day vulnerability, see Microsoft Security Advisory 932553.

                     Post this story to del.icio.us
               Post this story to Digg
    Post this story to Slashdot