Rob Vamosi's
award-winning
column on Internet threats and how to counter them
Delivered Mondays

CNET Security Center: Your complete source of antivirus and Internet security information.

Unspecified vulnerability in Microsoft Excel
Zero-day exploit targets Microsoft Excel spreadsheets.
By Robert Vamosi (July 5, 2006)

QUICK FACTS

Name: Unspecified vulnerability in Microsoft Excel

Date first reported: 6/15/06

Software vulnerable: All versions of Microsoft Excel

What it does: Allows remote attackers to execute arbitrary code on your PC

Recommendations: There is no workaround available. Do not open untrusted Office file attachments, nor should you follow Office file links from an untrusted Web site.

Exploit code available: Yes

Vendor patch available: MS06-037

5
out of 10

INTERNET THREAT RATING
How we rate

Just one day after Microsoft published its June 2006 security bulletins, criminal hackers exploited a previously unknown vulnerability within Microsoft Excel spreadsheet. They successfully used the exploit to attack at least one company.

Microsoft says it is looking into the problem and is not expected to release a patch before the next scheduled Patch Tuesday, July 11, 2006. The good news is that security researchers say that in order to execute the exploit, a victim must first open the malicious file. Therefore, it is recommended that users of Excel not accept .xls files from untrusted sources, nor should they visit untrusted Web sites offering Excel files for download.

Additional Resources:

Microsoft patch:MS06-037
Mitre.org: CVE-2006-3059
US-CERT Vulnerability: VU39444
Secunia advisory: 20686