Security Intelligence Operations

Microsoft Office Excel contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the user.

The vulnerability is due to an integer overflow error when processing formula information that is embedded within a cell of Excel documents.  An unauthenticated, remote attacker could exploit the vulnerability by convincing a user to open a malicious Excel document with a vulnerable application.  The attacker could trigger an exploitable integer overflow, enabling the attacker to execute arbitrary code with the privileges of the user.

Microsoft has confirmed the vulnerability and released updated software.

The following Microsoft products are vulnerable:

• Microsoft Excel 2000 SP3 and prior
• Microsoft Excel XP SP3 and prior
• Microsoft Excel 2003 SP3 and prior
• Microsoft Excel 2007 SP1 and prior
• Microsoft Office Compatibility Pack for Word, Microsoft Excel and PowerPoint 2007 File Formats SP1 and prior
• Microsoft Office Excel Viewer 2003 SP3 and prior
• Microsoft Office Excel Viewer 2007
• Microsoft Office 2004 for Mac
• Microsoft Office 2008 for Mac
• Microsoft Office SharePoint Server 2007 and SP1
• Microsoft Office SharePoint Server 2007 x64 Edition and SP1
• Open XML File Format Converter for Mac 1.0.1 and prior

To exploit the vulnerability, an attacker must convince a user to open a malicious Excel document, likely provided as part of an e-mail message or hosted on a website.  Attackers may use social engineering to convince users to open the provided document or visit the malicious website.  Attackers will likely provide links within a crafted e-mail message or other form of messaging to exploit the vulnerability.  An exploit could allow the attacker to execute arbitrary code with the privileges of the user. 

If the user holds Administrator privileges, the attacker could gain complete control over the affected system.  Systems that restrict user privileges or systems running Windows Vista may be at less risk because any code execution on such systems would run in a limited security context.

The Cisco Applied Intelligence team has created an Applied Mitigation Bulletin to address vulnerabilities that Microsoft disclosed in the October 2008 security bulletin release.  This Cisco bulletin, which assists administrators in identifying or mitigating these vulnerabilities using Cisco devices, is available at the following link: Cisco Applied Mitigation Bulletin: Microsoft Security Bulletin Release for October 2008

Microsoft has corrected the vulnerability by changing the way Excel loads documents into memory to avoid the integer overflow error.

Microsoft has released a security bulletin at the following link: MS08-057