Vulnerabilities in Microsoft Office Excel Could Cause Remote Code Execution (968557)

Version: 1.0

General Information

sID=’2l1-ENB’

Executive Summary

This security update resolves a privately reported and a publicly disclosed vulnerability. The vulnerabilities could allow remote code execution if the user opens a specially crafted Excel file. An attacker who successfully exploited these vulnerabilities could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

This security update is rated Critical for all supported editions of Microsoft Office Excel 2000. For all supported editions of Microsoft Office Excel 2002, Microsoft Office Excel 2003, Microsoft Office Excel 2007, Microsoft Office 2004 for Mac, and Microsoft Office 2008 for Mac; all supported versions of Microsoft Office Excel Viewer; and Microsoft Office Compatibility Pack Service Pack 1, this security update is rated Important. For more information, see the subsection, Affected and Non-Affected Software, in this section.

This security update addresses these vulnerabilities by modifying the way that Microsoft Office Excel opens Excel files. For more information about the vulnerability, see the Frequently Asked Questions (FAQ) subsection for the specific vulnerability entry under the next section, Vulnerability Information.

This security update also addresses the vulnerability first described in Microsoft Security Advisory 968272.

Recommendation. Microsoft recommends that customers apply the update immediately.

Many people used to access it from the button on the top of the print preview screen (Excel 2003 and prior). It is longer there.

It can now be found in one of two places.

1. At the bottom of the Excel window (usually just below the horizontal scroll bar to the left of the zoom control) there are 3 buttons. The 3rd button to the right is the Page Break Preview Button. Press this button to enter into the Page Break Preview mode. To exit the mode press the 1st button (called normal). This will return you to the normal view. See the image below to help you locate the relevant buttons.

2. The second method of toggling between the Page Break Preview view and the Normal view is on the View Ribbon. 1st click on the View Ribbon. Then select the Page Break Preview button or the Normal button to move between the 2 views. See the image below to help you locate the relevant buttons.

We encourage people to share this blog with others as well as post comments and questions.

We will from time to time post challenges out to the general public as well as ask people to vote on issues.

We also intend to share the good, the bad and the ugly issues surrounding Excel. Microsoft has done superb work on Excel yet there are issues that need to be addressed, and we hope that discussions around these issues will encourage Microsoft to take note and address them.

We hope that people find this blog usefull.