Microsoft has issued an advisory to warn users about the attacks, which target a flaw in the way code in Excel document files is handled. An attacker could use a specially-crafted Excel document file to cause a crash and remotely execute code on a target system.
The company said that the early reports of attacks are targeted and not believed to be widespread. However, Microsoft warned that the flaw being targeted exists in more than half a dozen currently-supported versions of Office, including Office 2000, 2002, 2003, and 2007 for Windows as well as Office 2004 and 2007 for MacOS X.
Though the company confirmed that a fix for the flaw is in the works, Microsoft did not specify whether the patch will be released as an "out of cycle " update or as a part of the next scheduled security update on March 10.
In addition to warnings over the Excel attacks, Microsoft released an update which shores up security for the AutoRun feature in Windows 2000, XP and Server 2003 systems.
The company said that the update should fix errors which could prevent users from correctly disabling parts of the AutoRun feature on certain drives.
The update will allow users and administrators to edit the AutoRun registry key to disable one or all of the autorun functions to improve system security.
Warnings sounded over Excel attacks
By
Shaun Nichols
on Feb 25, 2009 12:50PM
