Officials at the Microsoft Security Response Center are scrambling to investigate a second zero-day flaw in the Excel spreadsheet program, after a private researcher released exploit code to prove the extent of the vulnerability.
A company spokesperson confirmed to eWEEK that the new vulnerability could be exploited if a user is tricked into clicking on a hyperlink in Microsoft Office documents.
“Microsoft is not aware of any attacks based on this code or of customer impact at this time,” the spokesperson added.
Proof-of-concept code has been released on the Milw0rm site. Secunia, a security information aggregator based in Copenhagen, Denmark, rates the latest bug as “highly critical” and warned that successful exploitation will allow the execution of arbitrary code.
Secunia said the flaw was confirmed on fully patched Microsoft Office 2000, Excel Viewer 2003, Excel 2003, Excel 2002, Excel 2000, Microsoft Office 2003 Professional Edition, Microsoft Office 2003 and Microsoft Office XP.
/zimages/4/28571.gifFor advice on how to secure your network and applications, as well as the latest security news, visit Ziff Davis InternetsSecurity IT Hub.
In an alert published June 20, Secunia attributed the vulnerability to “a boundary error in hlink.dll within the handling of hyperlinks in Excel documents …[that] can be exploited to cause a stack-based buffer overflow by tricking a user into clicking a specially crafted hyperlink in a malicious Excel document.”
The company warned that the latest vulnerability “is quite simple to exploit” and urged Microsoft customers to avoid opening or following links in untrusted Office documents.
“It is likely that exploit code [will be] published soon,” the company warned.
The publication of a new Excel bug could not have come at a worse time for the Redmond, Wash., software maker. Microsoft is currently working on a patch for a code execution hole in Excel that has already been used in a highly targeted zero-day attack.
Microsoft has published an advisory with pre-patch workarounds to help businesses avoid potential attack
/zimages/4/28571.gifCheck out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.