Holes in PowerPoint and Excel

jeffy124 writes: "Looks like it's time for IIS and Outlook to make room on the pedestal of security holes. Just about every recent version of PowerPoint and Excel are vulnerable to being taken over to control the system remotely. The hole is a macro-related, as it's possible to bypass asking the user if they'd like a macro to run. Microsoft's advisory can be found here." Funny. I always thought that PowerPoint was already at least as destructive as macro viruses to corporate productivity. You ever watch a suit fiddle with his presentation?

Macs too

[liquide]

This vuln. works on Mac Office 2001 (and 98) too.

Linus likes PowerPoint

[Anonymous Coward]

I know I've read it somewhere, I believe in an interview in Linux Journal from a few years back. Linus stated at the time that PowerPoint was one of the Microsoft products that he liked using.

Not that it matters to me, but go ahead and knot up your undies in angst.

Re:This hole could be in more versions that listed

[Chanc_Gorkon]

Maybe something like recording keystrokes, but I was pretty sure there was no VBA in PowerPoint 95 and 97. The macro languages in Word and Excel were also incompatabile because of minor differences in each. At least for the 95 version. In the 95 version, there was WordBasic for Word (subset of VB) and VBA in Excel (Visual Basic for Applications...another subset of VB). In Office 2000 (it could be 97, but I thought it was 2000) everything got a compatible macro language. Thus the recent blossoming of macro virii. Personally, I have PowerPoint installed, but don't use it much. Only people I have ever seen use this are suits and sales monkey's.

It's amazing!

[famazza]

The most amazing thing of all these virii it that they all exist only due to one (and no more than one) function in the whole VBA language:

• CopyMacro

Maybe it has another name today, but it means exactly the same, copy a macro from a document to another. THAT'S AMAZING!!! Erradicating all these dam virii is much more easy to erradicate malaria from a non-tropical country, kill all the vectors.

That's wright we don't even need to kill the vector, all we need is to avoid the vectors to infect the host. This dam macro must not exist anymore!!!

Simple as that, and M$ doesn't seems to want to solve the problem.

Somebody tell the suits what this costs

[BroadbandBradley]

I work for a BIG company, (fortune 500) that runs MS Exchange server for mail. We recently upgraded from 95 to 2000 just a few months ago. (support for our working Win95 system having been discontinued by MS) The overhead created by all the security stuff running on the network has created lots of problems. Email is no longer 'realtimeish' meaning it may take 1/2 hour to recieve a message sent across our network. When right clicking in my browser window, it takes about 5 seconds for a menu to open (pentium III 500 128meg ram). My home pc runs Linux, and outperfoms my work computer at about half the hardware (PII 266)
IT has been trying to figure out how to fix the mail delays for a few months now with no progress, and I don't think they even care that it takes me so long to perform functions in the browser, but most of my work is done in web-based tools. MS has the world by the nuts, and they're milking us all!!! at least in my home I still have a choice.

Modifying Asimov's first law of robotics

[NZheretic]

Microsoft design choice not to include restrictive mode execution enviroments ( also known as "sandboxing" ) simliar to Javascript or Java's applets for Microsoft's embedded scripting puts users at risk when veiwing almost any disributed Microsoft document format.

I posted the following in various usenet groups last year. Given the recent events it is well worth the read...

Subject: Microsoft Applications Security
Date: 2000/05/28

http://groups.google.com/groups?selm=slrn8j2cen. pn [e-mail]

"This continued virus threat is not ONLY an email or Outlook problem it extends to all Microsoft Office products, Microsofts internet explorer as well as a lot of third party software for the Microsoft OS platforms."

Even with all the patches, anti-virus scanners and proxy firewall, it will not stop the average user clicking on an embedded https:// URL link in an email and downloading and opening a Microsoft format document with an embedded script containing a new "unknown" virus/malware.

Office users share documents over the net all the time, the inclusion of executable blocking, "run script" dialogs and digital script "signing" is a big improvement, but it all can be circumvented by a little social engineering.