CERT-In Vulnerability Note CIVN-2007-104
Microsoft Excel Remote Code Execution Vulnerability

Original Issue Date: August 16, 2007

Severity Rating: High

Systems Affected

• Microsoft Excel 2000
• Microsoft Excel 2002
• Microsoft Excel 2003
• Microsoft Excel Viewer 2003
• Microsoft Office 2000
• Microsoft Office 2003 Professional Edition
• Microsoft Office 2003 Small Business Edition
• Microsoft Office 2003 Standard Edition
• Microsoft Office 2003 Student and Teacher Edition
• Microsoft Office 2004 for Mac
• Microsoft Office XP

Overview

Remote code execution vulnerability has been reported in Microsoft Excel that could be exploited by an attacker to take complete control of the vulnerable system.


Description

The vulnerability in Microsoft Excel is caused due to insufficient input validation while processing an index value in the rtWnDesk record. The attacker could exploit this vulnerability to corrupt the memory via specially crafted Excel Workspace (XLW) file. Successful exploitation may allow execution of arbitrary code.

Workaround

• Use Microsoft Office File Block policy to block the opening of Office 2003 and earlier documents from unknown or un-trusted sources and locations.

Solution

Apply appropriate patches as mentioned in Microsoft Security Bulletin MS07-044


Vendor Information

Microsoft
http://www.microsoft.com/technet/security/bulletin/ms07-044.mspx


References

Secunia
http://secunia.com/advisories/26145/

CVE Name
CVE-2007-3890

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Communications and Information Technology
Electronics Niketan
6, C.G.O. Complex
New Delhi-110 003