---------------------------------------------------------------------- Did you know that a change in our assessment rating, exploit code availability, or if an updated patch is released by the vendor, is not part of this mailing-list? Click here to learn more: http://secunia.com/advisories/business_solutions/ ---------------------------------------------------------------------- TITLE: Microsoft Excel Multiple Vulnerabilities SECUNIA ADVISORY ID: SA31593 VERIFY ADVISORY: http://secunia.com/advisories/31593/ CRITICAL: Highly critical IMPACT: System access WHERE: >From remote SOFTWARE: Microsoft Open XML File Format Converter for Mac http://secunia.com/advisories/product/20148/ Microsoft Office Excel Viewer 2007 http://secunia.com/advisories/product/19210/ Microsoft Office Excel Viewer 2003 http://secunia.com/advisories/product/7700/ Microsoft Office Excel 2007 http://secunia.com/advisories/product/14161/ Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats http://secunia.com/advisories/product/14165/ Microsoft Office 2008 for Mac http://secunia.com/advisories/product/17922/ Microsoft Office 2004 for Mac http://secunia.com/advisories/product/8713/ Microsoft Excel 2003 http://secunia.com/advisories/product/4970/ Microsoft Excel 2002 http://secunia.com/advisories/product/4043/ Microsoft Excel 2000 http://secunia.com/advisories/product/3054/ Microsoft Office 2000 http://secunia.com/advisories/product/24/ Microsoft Office 2003 Professional Edition http://secunia.com/advisories/product/2276/ Microsoft Office 2003 Small Business Edition http://secunia.com/advisories/product/2277/ Microsoft Office 2003 Standard Edition http://secunia.com/advisories/product/2275/ Microsoft Office 2003 Student and Teacher Edition http://secunia.com/advisories/product/2278/ Microsoft Office 2007 http://secunia.com/advisories/product/13228/ Microsoft Office XP http://secunia.com/advisories/product/23/ DESCRIPTION: Some vulnerabilities have been reported in Microsoft Excel, which can be exploited by malicious people to compromise a user's system. 1) An error while validating an index value in a NAME record can be exploited to corrupt memory via a specially crafted Excel Spreadsheet (XLS) file. 2) An unspecified error in the processing of Excel records can be exploited to corrupt memory via a specially crafted XLS file. 3) An unspecified error in the processing of Excel formulas can be exploited to corrupt memory via a specially crafted XLS file. Successful exploitation of the vulnerabilities may allow execution of arbitrary code. SOLUTION: Apply patches. Microsoft Excel 2000 SP3: http://www.microsoft.com/downloads/details.aspx?FamilyId=f39d2a49-f861-4f2d-bf91-94a8a85af40c Microsoft Excel 2002 SP3: http://www.microsoft.com/downloads/details.aspx?FamilyId=72076e21-2aa3-48e8-883a-c3cb756fc72a Microsoft Excel 2003 SP3: http://www.microsoft.com/downloads/details.aspx?FamilyId=6c0771e5-fcd4-4365-b903-1a3bd95d9e66 Microsoft Excel 2007: http://www.microsoft.com/downloads/details.aspx?FamilyId=68bb8d99-f28b-4efd-9314-3eee0bb00ccf Microsoft Excel 2007 SP1: http://www.microsoft.com/downloads/details.aspx?FamilyId=68bb8d99-f28b-4efd-9314-3eee0bb00ccf Microsoft Office Excel Viewer 2003: http://www.microsoft.com/downloads/details.aspx?FamilyId=4b3989ef-02b8-4bd2-b2ab-c3716079936e Microsoft Office Excel Viewer 2003 SP3: http://www.microsoft.com/downloads/details.aspx?FamilyId=4b3989ef-02b8-4bd2-b2ab-c3716079936e Microsoft Office Excel Viewer: http://www.microsoft.com/downloads/details.aspx?FamilyId=9dbb35c1-aa7a-481b-a330-8ba916ddd443 Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats: http://www.microsoft.com/downloads/details.aspx?FamilyId=99cca4ed-f1f9-4cfd-a986-edbec82ced4f Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1: http://www.microsoft.com/downloads/details.aspx?FamilyId=99cca4ed-f1f9-4cfd-a986-edbec82ced4f Microsoft Office 2004 for Mac: http://www.microsoft.com/downloads/details.aspx?FamilyId=ECA13AD8-62AE-41A8-B308-41E2D1773820 Microsoft Office 2008 for Mac: http://www.microsoft.com/downloads/details.aspx?FamilyId=AB31A564-43D2-45BD-98BF-19E9CA477B62 Open XML File Format Converter for Mac: http://www.microsoft.com/downloads/details.aspx?FamilyId=EDB6CD8F-832C-4123-8982-AC0C601EA0A7 PROVIDED AND/OR DISCOVERED BY: 1) Dyon Balding, Secunia Research 2) The vendor credits Joshua J. Drake, VeriSign iDefense Labs. 3) The vendor credits Claes M Nyberg, signedness.org. ORIGINAL ADVISORY: MS08-074 (KB959070): http://www.microsoft.com/technet/security/Bulletin/MS08-074.mspx Secunia Research: http://secunia.com/secunia_research/2008-36/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------