Microsoft Offers Guidance on Excel Bug

Microsoft on Monday offered users a few tips on how to avoid falling victim to a critical bug in its Excel spreadsheet software.

Microsoft stopped short of issuing a fix for the vulnerability, which has to do with the way that Excel uses the computer’s memory, but the company said such an update is in the works.

In the meantime, Microsoft offered users a handful of workarounds to mitigate their risk. They were published Monday in a security advisory.

Reports of the vulnerability first began circulating late last week, when Microsoft said that hackers had launched a targeted attack against one of its customers using the vulnerability. The flaw could be exploited to run unauthorized software on a Windows PC, but for this to happen, attackers would first need to trick an Excel user into either visiting a malicious website or opening a malicious Excel attachment.

The bug exists in many versions of the spreadsheet software, including Excel 2000, Excel 2002 and Excel 2003, the advisory states.

Advanced Windows users can block the vulnerability by editing their registry settings or by setting up their e-mail gateway to block Excel attachments, Microsoft said. Users can also cut down on the risk by simply avoiding Excel documents that are sent from untrusted sources.

Microsoft is testing a security patch that fixes the problem, but a spokeswoman for the company’s public relations agency could not say whether it would be released as part of the company’s next round of security updates, expected July 11.

Microsoft’s security researchers have been busy over the past week. The Excel bug is being patched just days after the June security updates, which included 12 patches. Microsoft researchers also spent Monday investigating a hack that shut down part of the company’s French website.

Both Microsoft and security vendor Symantec say the vulnerability is being used in small-scale, targeted attacks and has not yet been seen in any widespread malware.

An unofficial frequently asked questions page on the vulnerability, with more details on the malware that exploits it, can be found here.

-Robert McMillan, IDG News Service (San Francisco Bureau)

Related Link:

• Vulnerability Found in Microsoft Excel

This article is posted on our Microsoft Informer page. For more news on the Redmond, Wash.-based powerhouse, keep checking in.

Check out our CIO News Alerts and Tech Informer pages for more updated news coverage.