Microsoft: Excel Bug Doesn&#39;t Add Up
302644
If you&#39;ve been depending on your Microsoft Excel software to do your number crunching for you, you might want to grab a calculator and review your spreadsheets before you send the document out the door. That&#39;s because the latest version of Excel is housing bugs that are dead set on ruining your reports.
271680
The latest version of Microsoft office for Macs incorrectly assigns ownership of some of its files when it's installed, causing a potential security problem for companies that are using the business suite.
766773
(InfoWorld) - With its monthly security updates due out Tuesday, Microsoft Corp. has a new problem to worry about: Word flaws. The software vendor on Sunday confirmed a report that criminals are e-mailing maliciously crafted Word attachments to victims. While these attacks are not widespread, they are dangerous because the attacker could run unauthorized software on the victim's computer if the attachment is opened. This is the second such Word attack to be confirmed by Microsoft in the past week. Last Tuesday, MicrosoftÂ warned of a similar Word flaw, saying that it was aware of "limited attacks attempting to use the vulnerability." Over the past year, hackers have increasingly looked to Microsoft's Office suite as a source of new bugs. Attacks based on flaws in Excel and PowerPoint have been reported as well. Exploits of this latest flaw appear to be even rarer than those based on last week's Word bug. "The vulnerability is being exploited on a very, very limited and targeted basis," Microsoft said in its alert. Neither problem is expected to be fixed in Tuesday's software patches, which will address flaws in Windows and Visual Studio. This second bug affects Word 2000, 2002, 2003 and the Word Viewer 2003, which are all vulnerable to last week's bug as well. The most recent version of the software, Word 2007, which was released to business users in late November, is not affected, Microsoft said. Â
500875
Intuit Inc. said that a patch for a bug in QuickBooks on the Mac that erased files from users' hard drives did not completely fix the flaw.
51437
eEye Digital Security has alerted Microsoft's bug team about a remote code vulnerabilityin Office 2007. Microsoft confirmed that  it's looking into the report.
342042
This month's Patch Tuesday will be a light one in comparison with those before it, with only three updates due next week. However, Microsoft's patch for Office shouldn't be taken lightly; its rating will be "Critical," the company said Thursday.
142322
Microsoft issues a security advisory noting several versions of its Microsoft Office Excel software contain vulnerabilities that attackers are targeting.
585848
Office for Mac 2008 incorrectly assigns ownership of some files, Microsoft has confirmed, creating a potential security problem for businesses installing the new application suite.Joel Bruner, a Chicago-based Mac consultant, was the first to notice the ownership snafu. "[Microsoft] moved to Apple's Package Maker (.pkg) installer files, good news for the enterprise, [but] unfortunately, they've created all the packages to install most all of the files with the owner set to 502."In a shop where employees run with limited privileges -- a practice very common in an enterprise -- and IT is the only user with full administrative rights, Office 2008's ownership assignment means that a user who wasn't supposed to have complete control over those files actually does. In other words, whomever is assigned user ID 502 has full read/write access to Office's files."So let's say, Mr. IT installs this on a user's machine where the first user is the admin[istrator] (501) and the standard user is Joe User (502)," said Bruner in a post to his blog on Monday. "Well, when after all's installed, it will give Joe User (502) ownership of these folders and their installed contents:/Library/Automator/ (if it doesn't exist already) /Library/Fonts/Microsoft /Library/Application Support/Microsoft /Applications/Microsoft Office 2008"The screw-up could present a corporate security problem, at least internally, said Bruner, if that Mac's second, standard user -- user 502 -- decides to make changes to the folders and files by, say, deleting some or moving others.A Microsoft developer left a comment at Bruner's blog confirming that the company knows about the problem. "The MacBU (Mac Business Unit) is aware of this issue," said Erik Schwiebert, a software design lead in the group.Microsoft, however, did not immediately respond to queries about how it intends to correct the problem and what users can do in the meantime.Other commenters at Bruner's blog hesitated to blame only Microsoft, however. "The truth is that this is a long-standing flaw in Apple's Installer," argued someone identified as Not Required. "Maybe Microsoft should have known better, but maybe Apple should also have improved their installer years ago. Apple clearly hasn't cared enough about smaller developers to make a fix, so hopefully Microsoft has a high enough profile that something finally gets done."In a follow-up post also on Monday, Bruner added that all the Office for Mac 2008 files owned by user 502 are also erroneously set as executable. "Now tell me does '/Microsoft Office 2008/Read Me.html' need to be executable for you to look at it?" asked Bruner. "Tick, tick, tick, *ding*! No. It does not."
182553
Double trouble Microsoft has warned of another unpatched vulnerability in Word. The unspecified code execution flaw means hackers can load malware onto targeted machines providing users are tricked into opening maliciously constructed Word files.â¦
111993
Previously satisfied users say the newest release of the software is causing a variety of problems, including an issue where the software won't load at startup. Microsoft says it is looking into at least one issue, but said overall the number of problems
538134
A flaw in numerous versions of Microsoft Excel is the vulnerability responsible for a number of ongoing attacks, the company confirmed Tuesday -- and the solution recommended is apt to raise hackles with those relying on files in older formats.
71569
(InfoWorld) - Microsoft's Office software is under attack again, this time with anÂ unpatched flaw in the Windows 2000 version of Office 2000 being usedÂ by hackersÂ to run unauthorized software on a victim's computer. Microsoft confirmed on Tuesday that the bug exists, but it would not say when it plans to fix the problem. The critical vulnerability wasÂ first reported by SymantecÂ to users of its DeepSight threat notification service. Attackers are exploiting the flaw by sending malicious Word documents to victims, Symantec said. When these documents are opened, Word is tricked into installing malicious software on the PC. Symantec is calling this malware Trojan.MDropper. Trojan.MDropper installs malicious software on the computer, which in turn installs another Trojan horse program "which turns out to be new variant of Backdoor.Femo," Symantec said in an Web posting. Symantec testers had not been able to exploit the problem on more up-to-date versions of Office or Windows. On Tuesday Microsoft said that the bug was confined to Microsoft Word 2000. Microsoft is investigating the issue and may issue a patch once that investigation is completed, according to the company's public relations agency. Microsoft has spent a lot of timeÂ investigating and patching Office applications this year. Over the past few months there have been several reports concerning very targeted attacks, similar to this latest Office issue. Microsoft's last few security updatesÂ have been filled with patches for Office flaws, many of which had already been used in attacks.
557147
Hoping to get some work done on a recent train trip to New York, I kicked back, opened my laptop, and clicked on Microsoft Excel. Up popped a prompt asking for the original program disk. Same thing with Word and PowerPoint. Nothing would run.
491983
commentary Microsoft was a little unhappy with an article I wrote this week because it contained a slight factual error. The error arose from two separate companies finding an almost identical security hole
174102
Zawodny  threads off of Scoble  on the IE issue:  "I have to say, when I first read that I nearly fell off my chair laughing. I was thinking "how stupid ARE these IE guys?!?!?!" But we all know that Microsoft is full of smart people who care about what they're doing. So something really doesn't compute here."  "Last time I checked, IE wasn't even close to feature parity with Mozilla's browsers. No popup blocking, no tabbed browsing, etc."  "Does the IE team really not know what their product is missing?"  Perhaps.  It's highly likely that they just don't know.  The bigger issue here is that Microsoft products can't fail and they can't succeed.  Microsoft has 40-50 billion in the bank.  There ...
567330
Microsoft's clutch of security updates this month will probably include a fix for a vulnerability in Excel that has been exploited by attackers for several weeks.
716244
Two small browsers are very definitely chomping at Microsoft&#39;s leg, rather than merely nipping at its heels. And now Savvysoft says Microsoft is demanding that it drop the name Excel from its TurboExcel product