P-009: Microsoft Excel Vulnerability Could Allow Remote Code Execution

[***** Start Microsoft Security Bulletin MS04-033 *****]

Microsoft Security Bulletin MS04-033
Vulnerability in Microsoft Excel Could Allow Remote Code Execution (886836)

Issued: October 12, 2004
Version: 1.0

Vulnerability in Microsoft Excel Could Allow Code Remote Execution

Who should read this document: Customers who use Microsoft Excel 2000, Microsoft 
Excel 2002, Microsoft Excel 2001 for Mac, or Microsoft Excel v. X for Mac

Impact of Vulnerability:  Remote Code Execution

Maximum Severity Rating: Critical

Recommendation: Customers should apply the update immediately.

Security Update Replacement: MS03-050

Caveats: None

Tested Software and Security Update Download Locations:

Affected Software: 

• Microsoft Office 2000 Software Service Pack 3 - Download the update (KB873372)

Microsoft Office 2000 Service Pack 3 Software:

• Excel 2000
 
 
• Microsoft Office XP Software Service Pack 2 - Download the update (KB873366)

Microsoft Office XP Software:

• Excel 2002
 
 
• Microsoft Office 2001 for Mac - Download the update

Microsoft Office 2001 for Mac:

• Excel 2001 for Mac
 
 
• Microsoft Office v. X for Mac - Download the update

Microsoft Office v. X for Mac:

• Excel v. X for Mac
 
 

Non-Affected Software:

• Microsoft Office XP Service Pack 3
 
• Microsoft Office Excel 2003
 
• Microsoft Office 2003 Service Pack 1
 
• Microsoft Excel 2004 for Mac
 

The software in this list has been tested to determine if the versions are 
affected. Other versions either no longer include security update support 
or may not be affected. To determine the support lifecycle for your product 
and version, visit the following Microsoft Support Lifecycle Web site.

Top of section
General Information
 Executive Summary 

Executive Summary:

This update resolves a newly-discovered, privately reported vulnerability. 
A remote code execution vulnerability exists in Microsoft Excel. The 
vulnerability is documented in the Vulnerability Details section of this 
bulletin.

If a user is logged on with administrative privileges, an attacker who 
successfully exploited this vulnerability could take complete control of 
an affected system, including installing programs; viewing, changing, 
or deleting data; or creating new accounts with full privileges. Users 
whose accounts are configured to have fewer privileges on the system 
would be at less risk than users who operate with administrative 
privileges.

Severity Ratings and Vulnerability Identifiers:

Vulnerability Identifiers                 : Vulnerability in Microsoft Excel 
                                            Vulnerability - CAN-2004-0846
Impact of Vulnerability                   : Remote Code Execution
Office 2000 SP3 and Excel 2000            : Critical
Office XP SP2 and Excel 2002              : Critical
Office 2001 for Mac and Excel 2001 for Mac: Important
Office v. X for Mac and Excel v. X for Mac: Important
 

This assessment is based on the types of systems that are affected by the 
vulnerability, their typical deployment patterns, and the effect that 
exploiting the vulnerability would have on them.

Top of section
 Frequently asked questions (FAQ) related to this security update 

Top of section
 Vulnerability Details 

Top of section
Top of section
Top of section
 Security Update Information 

Installation Platforms and Prerequisites:

For information about the specific security update for your platform, 
click the appropriate link:

 Office XP and Excel 2002 

 Prerequisites and Additional Update Details 

Important  Before you install this update, make sure that the following 
requirements have been met:

• Microsoft Windows Installer 2.0 must be installed. Microsoft Windows Server 
2003, Windows XP and Microsoft Windows 2000 Service Pack 2 (SP2) include Windows 
Installer 2.0 or later. To install the latest version of the Windows Installer, 
visit one of the following Microsoft Web sites:

Windows Installer 2.0 for Windows 95, Windows 98, Windows 98 SE, and Windows 
Millennium Edition

Windows Installer 2.0 for Windows 2000 and Windows NT 4.0
 

Top of section
 Automated Client Installation Information 

Top of section
 Manual Client Installation Information 



Top of section
 Administrative Installation Information 



Top of section
Top of section
 Office 2000 and Excel 2000 


Top of section
Top of section
 Excel v. X for Mac 

Top of section
 Excel 2001 for Mac 

Top of section
Top of section
Acknowledgments

Microsoft thanks the following for working with us to help protect customers:

• Brett Moore of Security-Assessment.com for reporting the Excel Vulnerability 
  (CAN-2004-0846).
 

Obtaining Other Security Updates:

Updates for other security issues are available from the following locations:

• Security updates are available from the Microsoft Download Center. You can 
  find them most easily by doing a keyword search for "security_patch."
 
• Updates for consumer platforms are available from the Windows Update Web site.
 

Support: 

• Customers in the U.S. and Canada can receive technical support from Microsoft 
  Product Support Services at 1-866-PCSAFETY. There is no charge for support   
  calls that are associated with security updates.
 
• International customers can receive support from their local Microsoft 
  subsidiaries. There is no charge for support that is associated with security 
  updates. For more information about how to contact Microsoft for support issues, 
  visit the International Support Web site.
 

Security Resources: 

• The Microsoft TechNet Security Web site provides additional information about 
  security in Microsoft products.
 
• Microsoft Software Update Services
 
• Microsoft Baseline Security Analyzer (MBSA)
 
• Windows Update 
 
• Windows Update Catalog: For more information about the Windows Update Catalog, 
  see Microsoft Knowledge Base Article 323166.
 
• Office Update 
 

Software Update Services:

By using Microsoft Software Update Services (SUS), administrators can quickly and 
reliably deploy the latest critical updates and security updates to Windows 2000 
and Windows Server 2003-based servers, and to desktop Windows 2000 
Professional or Windows XP Professional.

For more information about how to deploy this security update with Software Update 
Services, visit the Software Update Services Web site.

Systems Management Server:

Microsoft Systems Management Server (SMS) delivers a highly-configurable 
enterprise solution for managing updates. By using SMS, administrators can 
identify Windows-based systems that require security updates and to perform 
controlled deployment of these updates throughout the enterprise with minimal 
disruption to end users. For more information about how administrators can use 
SMS 2003 to deploy security updates, see the SMS 2003 Security Patch Management 
Web site. SMS 2.0 users can also use Software Updates Service Feature Pack to 
help deploy security updates. For information about SMS, visit the SMS Web site.

Note SMS uses the Microsoft Baseline Security Analyzer and the Microsoft Office 
Detection Tool to provide broad support for security bulletin update detection 
and deployment. Some software updates may not be detected by these tools. 
Administrators can use the inventory capabilities of the SMS in these cases 
to target updates to specific systems. For more information about this 
procedure, visit the following Web site. Some security updates require 
administrative rights following a restart of the system. Administrators can 
use the Elevated Rights Deployment Tool (available in the SMS 2003 Administration 
Feature Pack and in the SMS 2.0 Administration Feature Pack) to install these updates.

Disclaimer: 

The information provided in the Microsoft Knowledge Base is provided "as is" 
without warranty of any kind. Microsoft disclaims all warranties, either 
express or implied, including the warranties of merchantability and fitness 
for a particular purpose. In no event shall Microsoft Corporation or its 
suppliers be liable for any damages whatsoever including direct, indirect, 
incidental, consequential, loss of business profits or special damages, 
even if Microsoft Corporation or its suppliers have been advised of the 
possibility of such damages. Some states do not allow the exclusion or 
limitation of liability for consequential or incidental damages so the 
foregoing limitation may not apply.

Revisions: 

• V1.0 (October 12, 2004): Bulletin published
 
[***** End Microsoft Security Bulletin MS04-033 *****]

    Voice:          +1 866-941-2472 (7 x 24)
    E-mail:          doecirc@doecirc.energy.gov
    World Wide Web:  http://www.doecirc.energy.gov/