http://www.eweek.com/article2/0,1895,1978835,00.asp By Ryan Naraine June 19, 2006 Microsoft's security response center is recommending that businesses consider blocking Excel spreadsheet attachments at the network perimeter to help thwart targeted attacks that exploit an unpatched software vulnerability. The Redmond, Wash., software giant published a pre-patch advisory on June 19 with a list of workarounds that include blocking Excel file-types at the e-mail gateway. File extensions associated with the widely deployed Microsoft Excel program are: xls, xlt, xla, xlm, xlc, xlw, uxdc, csv, iqy, dqy, rqy, oqy, xll, xlb, slk, dif, xlk, xld, xlshtml, xlthtml and xlv. The company's guidance comes just a few days after public confirmation that a new, undocumented Excel flaw was being used in an attack against an unidentified business target. The attack resembles a similar exploit that targeted Microsoft Word users, prompting suspicion among security researchers that the attacks may be linked. The Excel attack includes the use of Trojan horse program called Trojan.Mdropper.J that arrives as an Excel spreadsheet with the file name "okN.xls." When the Trojan is executed, it exploits the Excel flaw to drop and execute a second piece of malware called Downloader.Booli.A. It then silently closes Microsoft Excel. Downloader.Booli.A attempts to run Internet Explorer and inject its code into the browser to bypass firewalls. It then connects to a remote Web site hosted in Hong Kong to download another unknown file. In the latest advisory, Microsoft confirmed that the vulnerability exists in Excel 2003, Excel Viewer 2003, Excel 2002, Excel 2000, Microsoft Excel 2004 for Mac, and Microsoft Excel v. X for Mac. Excel 2000 users are at highest risk because the program does not prompt the user to Open, Save, or Cancel before opening a document. Other versions of the software present a warning before a file is opened, Microsoft said. The company insists that a user must first open a malicious Excel file attached to an e-mail or otherwise provided to them by an attacker to be at risk. The flaw is described as "improper memory validation" in Excel that occurs only when the program goes into repair mode. Microsoft also recommends that businesses using Excel 2003 prevent Excel Repair mode by modifying the ACL (Access Control List) in the Excel Resiliency registry key. Detailed instructions can be found in the advisory. Microsoft said businesses should also consider blocking the ability to open Excel documents from Outlook as attachments, Web sites and the file system directly. This can be done by removing the registry keys that associate the Excel documents with the Excel application. As best practice, the company said Excel users should remember to be very careful opening unsolicited attachments from both known and unknown sources. _________________________________ Attend the Black Hat Briefings and Training, Las Vegas July 29 - August 3 2,500+ international security experts from 40 nations, 10 tracks, no vendor pitches. www.blackhat.com
This archive was generated by hypermail 2.1.3 : Mon Jun 19 2006 - 23:35:55 PDT