-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
A  U  S  C  E  R  T                                           A  L  E  R  T

                       AL-2008.0102 -- AUSCERT ALERT
                                [Win][OSX]
         MS08-057 - Critical - Vulnerabilities in Microsoft Excel
                     Could Allow Remote Code Execution
                              15 October 2008

===========================================================================

        AusCERT Alert Summary
        ---------------------

Product:              Excel 2000 Service Pack 3
                      Excel 2002 Service Pack 3
                      Excel 2003 Service Pack 2
                      Excel 2003 Service Pack 3
                      Excel 2007
                      Excel 2007 Service Pack 1
                      Microsoft Office Excel Viewer 2003
                      Microsoft Office Excel Viewer 2003 Service Pack 3
                      Microsoft Office Excel Viewer
                      Microsoft Office Compatibility Pack for Word, Excel,
                        and PowerPoint 2007 File Formats
                      Microsoft Office Compatibility Pack for Word, Excel,
                        and PowerPoint 2007 File Formats Service Pack 1
                      Microsoft Office SharePoint Server 2007
                      Microsoft Office SharePoint Server 2007 Service Pack 1
                      Microsoft Office SharePoint Server 2007 x64 Edition
                      Microsoft Office SharePoint Server 2007 x64 Edition
                        Service Pack 1
                      Microsoft Office 2004 for Mac
                      Microsoft Office 2008 for Mac
                      Open XML File Format Converter for Mac
Publisher:            Microsoft
Operating System:     Windows
                      Mac OS X
Impact:               Execute Arbitrary Code/Commands
Access:               Remote/Unauthenticated
CVE Names:            CVE-2008-4019 CVE-2008-3477 CVE-2008-3471

Original Bulletin:  
  http://www.microsoft.com/technet/security/bulletin/ms08-057.mspx

- --------------------------BEGIN INCLUDED TEXT--------------------

Microsoft Security Bulletin MS08-057 - Critical

Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution
(956416)

   Published: October 14, 2008

   Version: 1.0

General Information

Executive Summary

   This security update resolves three privately reported vulnerabilities
   in Microsoft Office Excel that could allow remote code execution if a
   user opens a specially crafted Excel file. An attacker who
   successfully exploited these vulnerabilities could take complete
   control of an affected system. An attacker could then install
   programs; view, change, or delete data; or create new accounts with
   full user rights. Users whose accounts are configured to have fewer
   user rights on the system could be less impacted than users who
   operate with administrative user rights.

   This security update is rated Critical for all supported editions of
   Microsoft Office Excel 2000 and rated Important for all supported
   editions of Microsoft Office Excel 2002, Microsoft Office Excel 2003,
   Microsoft Office Excel Viewer 2003, Microsoft Office Excel 2007,
   Microsoft Office Compatibility Pack , Microsoft Office Excel Viewer,
   and Microsoft Office SharePoint Server 2007. For more information, see
   the subsection, Affected and Non-Affected Software, in this section.

   This security update addresses these vulnerabilities by modifying the
   way that Microsoft Excel performs validations when opening Excel
   files. 

   Recommendation. Microsoft recommends that customers apply the update
   immediately.

Affected Software

   Excel 2000 Service Pack 3

   Excel 2002 Service Pack 3

   Excel 2003 Service Pack 2

   Excel 2003 Service Pack 3

   Excel 2007

   Excel 2007 Service Pack 1

   Microsoft Office Excel Viewer 2003

   Microsoft Office Excel Viewer 2003 Service Pack 3

   Microsoft Office Excel Viewer

   Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint
   2007 File Formats

   Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint
   2007 File Formats Service Pack 1

   Microsoft Office SharePoint Server 2007

   Microsoft Office SharePoint Server 2007 Service Pack 1

   Microsoft Office SharePoint Server 2007 x64 Edition

   Microsoft Office SharePoint Server 2007 x64 Edition Service Pack 1

   Microsoft Office 2004 for Mac

   Microsoft Office 2008 for Mac

   Open XML File Format Converter for Mac

Vulnerability Information

Calendar Object Validation Vulnerability - CVE-2008-3477

   A remote code execution vulnerability exists in the way Excel
   processes a VBA Performance Cache. The vulnerability could allow
   remote code execution if a user opens a specially crafted Excel file
   in a VBA Performance Cache. An attacker who successfully exploited
   this vulnerability could take complete control of an affected system.
   An attacker could then install programs; view, change, or delete data;
   or create new accounts with full user rights.

Workarounds for Calendar Object Validation Vulnerability - CVE-2008-3477

   Use the Microsoft Office Isolated Conversion Environment (MOICE) when
   opening files from unknown or un-trusted sources

   Use Microsoft Office File Block policy to block the opening of Office
   2003 and earlier documents from unknown or untrusted sources and
   locations

   Modify Access Control List (ACL) on VBE6.DLL to deny access to the
   Everyone group

File Format Parsing Vulnerability - CVE-2008-3471

   A remote code execution vulnerability exists in Microsoft Excel as a
   result of improper memory allocation when loading Excel objects. The
   vulnerability could allow remote code execution if a user opens a
   specially crafted Excel file that includes a malformed object. An
   attacker who successfully exploited this vulnerability could take
   complete control of an affected system. An attacker could then install
   programs; view, change, or delete data; or create new accounts with
   full user rights.

Workarounds for File Format Parsing Vulnerability - CVE-2008-3471

   Use the Microsoft Office Isolated Conversion Environment (MOICE) when
   opening files from unknown or un-trusted sources

   Use Microsoft Office File Block policy to block the opening of Office
   2003 and earlier documents from unknown or untrusted sources and
   locations

Formula Parsing Vulnerability - CVE-2008-4019

   The specific flaw exists when parsing Microsoft Excel documents
   containing a specially crafted formula embedded inside a cell. This
   can result in a remote compromise of the system under the context of
   the currently logged in user.

Workarounds for Formula Parsing Vulnerability - CVE-2008-4019

   Microsoft has not identified any workarounds for this vulnerability.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBSPVI6Sh9+71yA2DNAQLxTgQAigivCRzCeoGSk16tcpWuV8n8r3aVIcXn
Mk1EWEEOCXPRSrstRkJtMd8bst4lh3ubjGmG1bm9WJDzM2/7OCyxkuZdNGBRKuRc
YRyxuJnTbxew2Y8lBuX6CBq38EDT3jvuNFq+Fq/z/2Co0awex7Yqdmazb4ZUrjYc
jhPaPfYWn00=
=94sx
-----END PGP SIGNATURE-----