vendor:
Excel
by:
SecurityFocus
9.3
CVSS
HIGH
Remote Code-Execution
119
CWE
Product Name: Excel
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: YES
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Simplified Chinese, Traditional Chinese, Japanese, or Korean Windows
2006
Microsoft Excel Remote Code-Execution Vulnerability
Microsoft Excel is prone to a remote code-execution vulnerability. Successfully exploiting this issue allows attackers to execute arbitrary code in the context of targeted users. A proof-of-concept malicious code named 'Trojan.Hongmosa' is actively exploiting this vulnerability, which results in crashing Excel running on Simplified Chinese, Traditional Chinese, Japanese, or Korean Windows. Note that Microsoft Office applications include functionality to embed Office files as objects contained in other Office files. As an example, Microsoft Word files may contain embedded malicious Microsoft Excel files, making Word documents another possible attack vector.
Mitigation:
Users should exercise caution when opening files from untrusted sources. Microsoft has released a patch to address this issue.
