Microsoft Excel File Import Macro Execution Vulnerability

Bugtraq ID:	728
Class:	Design Error
CVE:
Remote:	Unknown
Local:	Yes
Published:	Oct 20 1999 12:00AM
Updated:	Oct 20 1999 12:00AM
Credit:	The vulnerability was reported to Microsoft by David Young of Derby, UK.
Vulnerable:	Microsoft Office 97 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 Microsoft Excel 97 SR2 Microsoft Excel 97 SR1 Microsoft Excel 97 + Microsoft Office 97 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0
Not Vulnerable:

Microsoft Excel File Import Macro Execution Vulnerability

When a Lotus 1-2-3 or Quattro Pro file containing a macro is opened by Excel 97, the user is not warned that a macro will be executed upon opening the file (as is customary when Excel opens other spreedsheet files containing macros.)

Microsoft Excel File Import Macro Execution Vulnerability

see discussion.

Microsoft Excel File Import Macro Execution Vulnerability

Solution:
Microsoft has released a patch for this vulnerability. It is available at:

- Excel 97:
http://officeupdate.microsoft.com/downloadDetails/Xl8p7pkg.htm
- Excel 2000:
http://officeupdate.microsoft.com/2000/downloadDetails/XL9p1pkg.htm

Microsoft Excel File Import Macro Execution Vulnerability

References:

• Microsoft Security Bulletin MS99-044: Frequently Asked Questions (Microsoft)
  
• Q241900: XL97: Opening Lotus 1-2-3 File May Execute Macro Without Warning (Microsoft)