Microsoft Focuses On Office With Security Patches

Microsoft has released another, albeit small, batch of patches for the monthly update. All of the patches released center on Microsoft Office and backend products.

Microsoft has released another, albeit small, batch of patches for the monthly update. All of the patches released center on Microsoft Office and backend products.

MS08-014:
Addresses a flaw in Microsoft Excel that can lead to remote code execution, this was discovered in January according to some reports, and made it to the patch list rather fast. The update is rated Critical for Microsoft Office Excel 2000 Service Pack 3 and rated Important for Excel 2002 Service Pack 3, Excel 2003 Service Pack 2, Excel Viewer 2003, Excel 2007, and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats. This is also included in fixes for Office 2004 for Mac and Office 2008 for Mac.

more...


Microsoft today released critical security patches for its Office software, fixing a flaw in Excel that had been exploited by attackers for the past two months.

The bug fixes were released in four software updates for Excel, Outlook, Office 2000, and Office's Web components. Microsoft rates all of the updates as critical, meaning that an attacker could theoretically exploit these flaws in order to hack into a victim's computer.

In total, 12 vulnerabilities are fixed in the four updates.

Office Only
Typically Microsoft includes bug fixes for Windows or Internet Explorer in its monthly security updates, and security experts said Tuesday that this is the first time they could remember Microsoft focusing the patches exclusively on Office.

It's a sign of the times, according to Paul Zimski, senior director of market strategy with Lumension.

Between 2006 and 2007 the number of attacks targeting Office software doubled, he said. "Malicious entities are looking toward Office as a vector for delivering malicious code," he said. "You can't really mitigate against Office: organizations can't block Office attachments and Office documents are generally trusted by users."

Pay Special Attention
Although all of Tuesday's updates are critical, system administrators will want to pay special attention to MS08-014, because it fixes a publicly disclosed flaw that hackers have been exploiting for several months now. "This is the long awaited patch for the Excel zero day issue first reported in mid-January 2008," said Eric Schultze, chief security architect with Shavlik Technologies, via instant message. "Angst-ridden computer users can now sleep easy knowing that they can now open malicious Excel documents without fear of being hacked."

"Patch this one as soon as possible if you visit illicit Web sites or open malformed Excel documents on a regular basis," he added.

This previously disclosed bug affects users of Excel 2000, 2002 and 2003, and Service Pack 2, although customers with Excel 2007 or Excel 2003, Service Pack 3 are not at risk, according to Microsoft.

Another update to watch is the MS08-015 patch, which contains a flaw that could be easily exploited by attackers. By tricking the victim into clicking on a specially crafted "mailto" Web link, an attacker could "install programs; view, change, or delete data; or create new accounts with full user right," Microsoft said in its security bulletin.

These types of bugs, called URI (Uniform Resource Identifier) handling flaws, have been increasingly studied by hackers and security researchers over the past year, and they have led to a number of effective Web-based attacks.

Schultze said that he would patch the MS08-015 update before all others. That's because, while users may now be learning to hesitate before opening untrusted Office documents, they generally don't think twice about clicking on a Web link.

"Clicking on the e-mail link can allow the attacker to run code on your system, assuming that you have Microsoft Outlook," Schultze said. "There would be very little way to know ahead of time whether or not the mail link was evil. I expect we'll see exploit code for this very shortly."

The two other security updates fix critical flaws in Office and in the Office Web Components ActiveX controls used by products such as Office, BizTalk Server, Commerce Server, and the Internet Security and Acceleration (ISA) Server.