-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
A  U  S  C  E  R  T                                           A  L  E  R  T

                       AL-2008.0123 -- AUSCERT ALERT
                              [Win][Mac][OSX]
         MS08-074 - Critical - Vulnerabilities in Microsoft Office
                  Excel Could Allow Remote Code Execution
                              29 January 2009

===========================================================================

        AusCERT Alert Summary
        ---------------------

Product:              Microsoft Office 2000 Service Pack 3
                      Microsoft Office Excel 2000 Service Pack 3
                      Microsoft Office XP Service Pack 3
                      Microsoft Office Excel 2002 Service Pack 3
                      Microsoft Office 2003 Service Pack 3
                      Microsoft Office Excel 2003 Service Pack 3
                      2007 Microsoft Office System
                      Microsoft Office Excel 2007
                      2007 Microsoft Office System Service Pack 1
                      Microsoft Office Excel 2007 Service Pack 1
                      Microsoft Office Excel Viewer 2003
                      Microsoft Office Excel Viewer 2003 Service Pack 3
                      Microsoft Office Compatibility Pack for Word, Excel, 
                        and PowerPoint 2007 File Formats
                      Microsoft Office Compatibility Pack for Word, Excel, 
                        and PowerPoint 2007 File Formats Service Pack 1
                      Microsoft Office for Mac	
                      Microsoft Office 2004 for Mac
                      Microsoft Office 2008 for Mac
                      Open XML File Format Converter for Mac
Publisher:            Microsoft
Operating System:     Windows
                      Mac OS X
Impact:               Execute Arbitrary Code/Commands
Access:               Remote/Unauthenticated
CVE Names:            CVE-2008-4265 CVE-2008-4264 CVE-2008-4266

Original Bulletin:    
  http://www.microsoft.com/technet/security/bulletin/ms08-074.mspx

Revision History:      January 29 2009: Footnote added to Affected Software 
                                        and Revision information added
                      December 10 2008: Initial Release

- --------------------------BEGIN INCLUDED TEXT--------------------

Microsoft Security Bulletin MS08-074 - Critical
Vulnerabilities in Microsoft Office Excel Could Allow Remote Code 
Execution (959070)

   Published: December 9, 2008

   Version: 1.0

General Information

Executive Summary

   This security update resolves three privately reported vulnerabilities in 
   Microsoft Office Excel that could allow remote code execution if a user 
   opens a specially crafted Excel file. An attacker who successfully exploited 
   these vulnerabilities could take complete control of an affected system. An 
   attacker could then install programs; view, change, or delete data; or 
   create new accounts with full user rights. Users whose accounts are 
   configured to have fewer user rights on the system could be less impacted 
   than users who operate with administrative user rights.

   This security update is rated Critical for all supported editions of 
   Microsoft Office Excel 2000. For all supported editions of Microsoft Office 
   Excel 2002, Microsoft Office Excel 2003, Microsoft Office Excel Viewer 2003, 
   Microsoft Office Excel 2007, Microsoft Office Compatibility Pack, Microsoft 
   Office Excel Viewer, Microsoft Office 2004 for Mac, Microsoft Office 2008 
   for Mac, and Open XML File Format Converter for Mac, this security update is 
   rated Important. For more information, see the subsection, Affected and 
   Non-Affected Software, in this section.

   This security update addresses these vulnerabilities by modifying the way 
   that Microsoft Office Excel opens Excel files. For more information about 
   the vulnerability, see the Frequently Asked Questions (FAQ) subsection for 
   the specific vulnerability entry under the next section, Vulnerability 
   Information.

   Recommendation. Microsoft recommends that customers apply the update 
   immediately.

   Known Issues. Microsoft Knowledge Base Article 959070 documents the 
   currently known issues that customers may experience when installing this 
   security update. The article also documents recommended solutions for these 
   issues.

Affected Software

   Microsoft Office 2000 Service Pack 3
	
   Microsoft Office Excel 2000 Service Pack 3

   Microsoft Office XP Service Pack 3
	
   Microsoft Office Excel 2002 Service Pack 3

   Microsoft Office 2003 Service Pack 3

   Microsoft Office Excel 2003 Service Pack 3

   2007 Microsoft Office System
	
   Microsoft Office Excel 2007*

   2007 Microsoft Office System Service Pack 1
	
   Microsoft Office Excel 2007 Service Pack 1*

   Microsoft Office Excel Viewer 2003

   Microsoft Office Excel Viewer 2003 Service Pack 3

   Microsoft Office Excel Viewer

   Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 
   2007 File Formats

   Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 
   2007 File Formats Service Pack 1

   Microsoft Office for Mac	 	 	 	 

   Microsoft Office 2004 for Mac

   Microsoft Office 2008 for Mac

   Open XML File Format Converter for Mac

   * For Microsoft Office Excel 2007 and Microsoft Office Excel 2007 Service 
   Pack 1, in addition to security update package KB958437, customers also 
   need to install the security update for Microsoft Office Compatibility 
   Pack for Word, Excel, and PowerPoint 2007 File Formats (KB958439) to be 
   protected from the vulnerabilities described in this bulletin. Customers 
   who have already successfully installed both the KB958437 and KB958439 
   update packages do not need to reinstall.


Vulnerability Information

File Format Parsing Vulnerability - CVE-2008-4265

   A remote code execution vulnerability exists in Microsoft Office Excel 
   as a result of memory corruption when loading Excel records. The 
   vulnerability could allow remote code execution if a user opens a 
   specially crafted Excel file that includes a malformed object. An 
   attacker who successfully exploited this vulnerability could take 
   complete control of an affected system. An attacker could then install 
   programs; view, change, or delete data; or create new accounts with full 
   user rights.

File Format Parsing Vulnerability - CVE-2008-4264

   A remote code execution vulnerability exists in Microsoft Office Excel 
   as a result of pointer corruption when loading Excel formulas. The 
   vulnerability could allow remote code execution if a user opens a 
   specially crafted Excel file that includes a malformed formula. An 
   attacker who successfully exploited this vulnerability could take 
   complete control of an affected system. An attacker could then install 
   programs; view, change, or delete data; or create new accounts with full
   user rights.

Excel Global Array Memory Corruption Vulnerability - CVE-2008-4266

   A remote code execution vulnerability exists in Microsoft Office Excel 
   as a result of stack corruption when loading Excel records. The 
   vulnerability could allow remote code execution if a user opens a 
   specially crafted Excel file that includes a malformed object. An 
   attacker who successfully exploited this vulnerability could take 
   complete control of an affected system. An attacker could then install 
   programs; view, change, or delete data; or create new accounts with full 
   user rights.

Why was this bulletin revised on January 28, 2009?

   Microsoft revised this bulletin to communicate that for supported 
   versions of Microsoft Office Excel 2007, in addition to security update 
   package KB958437, customers also need to install the security update for 
   Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 
   File Formats (KB958439) to be protected from the vulnerabilities described 
   in this bulletin. Customers who have already successfully installed both 
   the KB958437 and KB958439 security update packages do not need to 
   reinstall.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation\'s
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT\'s members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation\'s
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author\'s website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBSYESqSh9+71yA2DNAQJmsgP/Zw+EzuYc/FC8k7on7UBSw5SF3UcGx9eH
biHVX2s9gS6wh5jfdLhUt1ywSM+m7e9qgci0VGIA/2hXmaWxCWeDe2R1Y/sWnAwD
QGL4loXhmfnxRqukUVAdNk9qxoiyWdMrxUplL3yew2f6xXzCRTHSb+BmbzvjsJqq
RZbzZholkOo=
=o70C
-----END PGP SIGNATURE-----