New Excel Vulnerabilities Targeted in Zero-Day Attacks

Published: June 21, 2006

by Alex Woodie

Two undisclosed vulnerabilities in Excel are being exploited in zero-day attacks, according to security analyst groups. Just as Microsoft posted a workaround on its TechNet security site for the first vulnerability on Monday, a second zero-day vulnerability surfaced on Tuesday. Users are advised to be very careful with Excel documents until the program can be patched, which may not be for weeks.

Microsoft said last week it became aware of an attack carried out that requires a user to open a maliciously crafted Excel spreadsheet. "We've received a single report from a customer being impacted by an attack using a new vulnerability in Microsoft Excel," said Microsoft's Mike Reavey in the company's Security Response Center Blog last Friday.

The first vulnerability affects all current versions of Excel, including Excel 2003, Excel Viewer 2003, Excel 2002, Excel 2000, Excel 2004 for Mac, and Excel v. X for Mac. Microsoft notes that, in order for this attack to be carried out, "a user must first open a malicious Excel document that is sent as an email attachment or otherwise provided to them by an attacker," Reavey says. Microsoft's TechNet security team had investigated the problem, and issued a workaround, or instructions on how to minimize exposure to the problem in lieu of a patch, in Microsoft Security Advisory 921365 on Monday.

A second zero-day vulnerability was reported Tuesday by security researcher Secunia. The group, in its advisory SA20748, says the flaw is triggered when users click on a malformed link (which could indicate a problem in the underlying Windows operating system and not necessarily in Excel). Secunia says the flaw is not being actively exploited; however, the vulnerability is very easy to exploit, the group says, and other publications have reported that exploit code is already making rounds on the Web.

The episodes are reminiscent of the recent zero-day attack on Word (see "Zero-Day Word Exploit Attacks from Asia Reported"). Microsoft patched that flaw last week. However, Excel users may have to wait until the next round of patches on July 11 for a fix for the newly discovered Excel vulnerabilities.