Microsoft Excel Worksheet Remote Code Execution Vulnerability

Bugtraq ID:	22555
Class:	Input Validation Error
CVE:	CVE-2007-3029
Remote:	Yes
Local:	No
Published:	Feb 14 2007 12:00AM
Updated:	Jul 13 2007 09:46PM
Credit:	SehaTo is credited with the discovery of this vulnerability.
Vulnerable:	Microsoft Office 2004 for Mac 0 Microsoft Excel 2003 SP3 Microsoft Excel 2003 SP2 Microsoft Excel 2003 SP1 + Microsoft Office 2003 SP1 Microsoft Excel 2003 + Microsoft Office 2003 0 Microsoft Excel 2002 SP3 + Microsoft Office XP SP3 Microsoft Excel 2002 SP2 + Microsoft Office XP SP2 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Microsoft Excel 2002 SP1 + Microsoft Office XP SP1 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Microsoft Excel 2002 + Microsoft Office XP - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 SR2 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Avaya Customer Interaction Express (CIE) User Interface 1.0.2 Avaya Customer Interaction Express (CIE) User Interface 1.0 Avaya CIE 1.0.2 Avaya CIE 1.0
Not Vulnerable:

Microsoft Excel Worksheet Remote Code Execution Vulnerability

Microsoft Excel is prone to a remote code-execution vulnerability.

Attackers may exploit this issue by enticing victims into opening a maliciously crafted Excel file (.xls).

Successful exploits may allow attackers to execute arbitrary code with the privileges of the user running the application. This may facilitate a compromise of vulnerable computers.

This issue was previously reported as a denial-of-service vulnerability, but has been updated to reflect new information.

Microsoft Excel Worksheet Remote Code Execution Vulnerability

A proof of concept is available from the following location; Symantec has not tested the integrity of this proof of concept:

http://securityvulns.com/files/example.xls

Microsoft Excel Worksheet Remote Code Execution Vulnerability

Solution:
Microsoft released an advisory and fixes to address this issue. Please see the references for more information.


Microsoft Excel 2002 SP3

• Microsoft Security Update for Excel 2002 (KB936513)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=5E09D13B-D4B0 -48FD-9880-73C180570267&displaylang=en

Microsoft Excel 2003 SP2

• Microsoft Security Update for Excel 2003 (KB936507)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=9D93C0CE-5124 -4234-BA84-3C27005E010F&displaylang=en

Microsoft Office 2004 for Mac 0

• Apple Office2004-1136UpdateEN.dmg
  http://download.microsoft.com/download/D/F/9/DF931C33-8A24-48D5-95C3-A 14640A60CB7/Office2004-1136UpdateEN.dmg

Microsoft Excel Worksheet Remote Code Execution Vulnerability

References:

• Microsoft Excel Homepage (Microsoft )
  
• ASA-2007-297 MS07-036 Vulnerabilities in Microsoft Excel Could Allow Remote Code (Avaya)
  
• Microsoft Security Bulletin MS07-036 - Vulnerabilities in Microsoft Excel Could (Microsoft)