Patch Available for Excel 'Symbolic Link' vulnerability
----------------------------------------------------------------------------
----
SUMMARY
Microsoft has released a patch that eliminates several vulnerabilities in
Excel '97 and 2000. These vulnerabilities allow attackers to run macros on
the victim's machine without asking permission (under normal circumstances
Excel warns users before running macros embedded in Excel worksheets).
These macros can be used to perform almost any action on the user's
machine.
DETAILS
There are two vulnerabilities that make it possible to bypass the macro
warning mechanism of Excel '97 and 2000.
When importing Macros from Lotus 1-2-3 or Quattro Pro, those macros are
launched without the user's permission (although these scripts can do very
little, they can be used to delete local files).
Also, when opening a symbolic link (SYLK) files that contain macros, Excel
will run the macros without requesting permission.
Affected Versions
Excel '97 and Excel 2000.
Fix Information
A patch is available at the following location:
- Excel 97:
<http://officeupdate.microsoft.com/downloadDetails/Xl8p7pkg.htm>
http://officeupdate.microsoft.com/downloadDetails/Xl8p7pkg.htm
- Excel 2000:
<http://officeupdate.microsoft.com/2000/downloadDetails/XL9p1pkg.htm>
http://officeupdate.microsoft.com/2000/downloadDetails/XL9p1pkg.htm
ADDITIONAL INFORMATION
Microsoft has also published several knowledge-base articles that describe
this vulnerability:
Microsoft Knowledge Base (KB) article Q241900,
XL97: Opening Lotus 1-2-3 File May Execute Macro Without Warning,
<http://support.microsoft.com/support/kb/articles/q241/9/00.asp>
http://support.microsoft.com/support/kb/articles/q241/9/00.asp.
Microsoft Knowledge Base (KB) article Q241901,
XL2000: Macro Virus Warning Does Not Appear Opening SYLK File,
<http://support.microsoft.com/support/kb/articles/q241/9/01.asp>
http://support.microsoft.com/support/kb/articles/q241/9/01.asp.
Microsoft Knowledge Base (KB) article Q241902,
XL97: Macro Virus Warning Does Not Appear Opening SYLK File,
<http://support.microsoft.com/support/kb/articles/q241/9/02.asp>
http://support.microsoft.com/support/kb/articles/q241/9/02.asp.
========================================
-------
AFLHI 058009990407128029/089802
milis ini didukung oleh :
>> http://www.indolinux.com - dunia linux indonesia
-------------------------------------------------------------------
untuk berhenti kirim email ke [EMAIL PROTECTED]
untuk melihat peraturan kirim email ke [EMAIL PROTECTED]
arsip berada di http://www.mail-archive.com/[email protected]
