Date: Mon, 8 Oct 2001 15:41:38 -0400 (EDT)
From: CERT Advisory <cert-advisory@cert.org>
To: cert-advisory@cert.org
Subject: CERT Advisory CA-2001-28
-----BEGIN PGP SIGNED MESSAGE-----
CERT Advisory CA-2001-28 Automatic Execution of Macros
Original release date: October 08, 2001
Last revised: -- Source: CERT/CC
A complete revision history can be found at the end of this file.
Systems Affected
Systems running:
* Windows
+ Microsoft Excel 2000
+ Microsoft Excel 2002
+ Microsoft PowerPoint 2000
+ Microsoft PowerPoint 2002
* Macintosh
+ Microsoft Excel 98
+ Microsoft Excel 2001
+ Microsoft PowerPoint 98
+ Microsoft PowerPoint 2001
Overview
An intruder can include a specially crafted macro in a Microsoft
Excel or PowerPoint document that can avoid detection and run
automatically regardless of the security settings specified by the
user.
I. Description
Microsoft Excel and PowerPoint scan documents when they are opened
and check for the existence of macros. If the document contains
macros, the user running Excel or PowerPoint is alerted and asked
if he would like the macros to be run. However, Microsoft Excel and
PowerPoint may not detect malformed macros, so a user can
unknowingly run macros containing malicious code when opening an
Excel or PowerPoint document.
An intruder who can entice or deceive a victim into opening a
document using a vulnerable version of Excel or PowerPoint could
take any action the victim could take, including, but not limited
to
* reading, deleting, or modifying data, either locally or on open
file shares
* modifying security settings (including macro virus protection
settings)
* sending electronic mail
* posting data to or retrieving data from web sites
For more information, please see
http://securityresponse.symantec.com/avcenter/security/Content/
2001.10.04.html
http://www.microsoft.com/technet/treeview/default.asp?url=/tech
net/security/bulletin/MS01-050.asp
Given the strong potential for widespread abuse of this
vulnerability, we strongly recommend that you apply patches as soon
as you are able. For example, the Melissa virus which spread in
March of 1999 used social engineering to convince victims to
execute a macro embedded in a Microsoft Word document. For more
information, see the CERT/CC Advisory listed below.
http://www.cert.org/advisories/CA-1999-04.html
As a general practice, everyone should be aware of the potential
damage that Trojan horses and other kinds of malicious code can
cause to any platform. For more information, see
http://www.cert.org/advisories/CA-1999-02.html
This vulnerability has been assigned the identifier CAN-2001-0718
by the Common Vulnerabilities and Exposures (CVE) group:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0718
II. Impact
An attacker can execute arbitrary code on the target system with
the privileges of the victim running Excel or PowerPoint.
III. Solution
Apply a patch
Appendix A contains information from vendors who have provided
information for this advisory. We will update the appendix as we
receive more information. If a vendor's name does not appear, then
the CERT/CC did not hear from that vendor. Please contact your
vendor directly.
Until a patch can be applied, and as a general practice, we
recommend using caution when opening attachments. However, it is
important to note that relying on the "From" line in an electronic
mail message is not sufficient to authenticate the origin of the
document.
Appendix A. - Vendor Information
This appendix contains information provided by vendors for this
advisory. When vendors report new information to the CERT/CC, we
update this section and note the changes in our revision
history. If a particular vendor is not listed below, we have not
received their comments.
Microsoft Corporation
See Microsoft Security Bulletin MS01-050
Appendix B. - References
1. http://securityresponse.symantec.com/avcenter/security/Content/200
1.10.04.html
2. http://www.microsoft.com/technet/treeview/default.asp?url=/technet
/security/bulletin/MS01-050.asp
3. http://www.kb.cert.org/vuls/id/287067
4. http://www.cert.org/advisories/CA-1999-04.html
5. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0718
_________________________________________________________________
_________________________________________________________________
The CERT Coordination Center thanks Peter Ferrie and Symantec
Security Response, who discovered this vulnerability and published
the information in their advisory. Additionally, we thank
Microsoft Corporation, who published an advisory on this issue.
_________________________________________________________________
Author: Ian A. Finlay and Shawn V. Hernan.
______________________________________________________________________
This document is available from:
http://www.cert.org/advisories/CA-2001-28.html
______________________________________________________________________
CERT/CC Contact Information
Email: cert@cert.org
Phone: +1 412-268-7090 (24-hour hotline)
Fax: +1 412-268-6989
Postal address:
CERT Coordination Center
Software Engineering Institute
Carnegie Mellon University
Pittsburgh PA 15213-3890
U.S.A.
CERT/CC personnel answer the hotline 08:00-17:00 EST(GMT-5) /
EDT(GMT-4) Monday through Friday; they are on call for emergencies
during other hours, on U.S. holidays, and on weekends.
Using encryption
We strongly urge you to encrypt sensitive information sent by
email. Our public PGP key is available from
http://www.cert.org/CERT_PGP.key
If you prefer to use DES, please call the CERT hotline for more
information.
Getting security information
CERT publications and other security information are available from
our web site
http://www.cert.org/
To subscribe to the CERT mailing list for advisories and bulletins,
send email to majordomo@cert.org. Please include in the body of
your message
subscribe cert-advisory
* "CERT" and "CERT Coordination Center" are registered in the U.S.
Patent and Trademark Office.
______________________________________________________________________
NO WARRANTY
Any material furnished by Carnegie Mellon University and the
Software Engineering Institute is furnished on an "as is"
basis. Carnegie Mellon University makes no warranties of any kind,
either expressed or implied as to any matter including, but not
limited to, warranty of fitness for a particular purpose or
merchantability, exclusivity or results obtained from use of the
material. Carnegie Mellon University does not make any warranty of
any kind with respect to freedom from patent, trademark, or
copyright infringement.
_________________________________________________________________
Conditions for use, disclaimers, and sponsorship information
Copyright 2001 Carnegie Mellon University.
Revision History
October 8, 2001: initial release
-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.8
iQCVAwUBO8H+YKCVPMXQI2HJAQHlegP+P6LyxsV880PLmLoip+dUJs6LcMER+t7r
uNU4MABB66f7B8pLNUTHI4cSzTdkH2mYC/fzdro92Z1t5VNTlMAQ3V27WP03OrU6
BdbduoHCXVWZMHYe1otl8ePPwPDwdYvajlEUoXSeG97Jl3pbA5wcCCvBdnRvhREr
gSzpV7t53FU=
=B68T
-----END PGP SIGNATURE-----
