Office users face new macro risk
The software hole allows a malformed macro to escape the security warnings built into Excel and PowerPoint, so that a user can unknowingly run infected macros when opening a spreadsheet or presentation.
The affected versions include: Microsoft Excel 2000 for Windows, Microsoft Excel 2002 for Windows, Microsoft Excel 98 for Macintosh, Microsoft Excel 2001 for Macintosh, Microsoft PowerPoint 2000 for Windows, Microsoft PowerPoint 2002 for Windows, Microsoft PowerPoint 98 for Macintosh and Microsoft PowerPoint 2001 for Macintosh.
"Macros have their own programming language, and can automate the tasks that a user would normally do," said Mark Read, security analyst at MIS Corporate Defence Solutions. "There is the potential for them to release code that could be very dangerous -- it doesn't matter what the application is."
The macro could be programmed to take any action that the owner of the PC could take. According to U.S. government Internet security organization CERT, this could include: reading, deleting or modifying data; modifying security settings; sending e-mail; or posting data on Web sites.
The strong potential for macro viruses was demonstrated on a massive scale two years ago with the Melissa virus. The macro virus propagated in the form of an email containing an infected Word document as an attachment. When a user opened an infected .doc file with Microsoft Word97 or Word2000, Melissa immediately executed itself if the macros were enabled.
"We've had macro viruses around for a long time--since Microsoft built the angle into its products, " said Read. "Microsoft added warnings giving the user an option to back out, but now this safeguard has been removed through this new vulnerability, creating new potentials for script-kiddies."
Microsoft has issued a security bulletin about the Excel and PowerPoint vulnerabilities on its site, but is refusing to make any further comment.