Pakistan Computer Emergency Response Team

The Security Standard


HOME | ABOUT US | SERVICES | ADVISORIES | RESOURCES | DEFACEMENT ARCHIVE | MEMBERS AREA | TRAINING | CONTACT US

Copyright | Disclaimer

 

 

 


 
CA-2001-28 Automatic Execution of Macros

-----BEGIN PGP SIGNED MESSAGE-----

CERT Advisory CA-2001-28 Automatic Execution of Macros

Original release date: October 08, 2001
Last revised: -- Source: CERT/CC

A complete revision history can be found at the end of this file.

Systems Affected

Systems running:
* Windows
+ Microsoft Excel 2000
+ Microsoft Excel 2002
+ Microsoft PowerPoint 2000
+ Microsoft PowerPoint 2002
* Macintosh
+ Microsoft Excel 98
+ Microsoft Excel 2001
+ Microsoft PowerPoint 98
+ Microsoft PowerPoint 2001

Overview

An intruder can include a specially crafted macro in a Microsoft
Excel or PowerPoint document that can avoid detection and run
automatically regardless of the security settings specified by the
user.

I. Description

Microsoft Excel and PowerPoint scan documents when they are opened
and check for the existence of macros. If the document contains
macros, the user running Excel or PowerPoint is alerted and asked
if he would like the macros to be run. However, Microsoft Excel and
PowerPoint may not detect malformed macros, so a user can
unknowingly run macros containing malicious code when opening an
Excel or PowerPoint document.

An intruder who can entice or deceive a victim into opening a
document using a vulnerable version of Excel or PowerPoint could
take any action the victim could take, including, but not limited
to

* reading, deleting, or modifying data, either locally or on open
file shares
* modifying security settings (including macro virus protection
settings)
* sending electronic mail
* posting data to or retrieving data from web sites

For more information, please see

http://securityresponse.symantec.com/avcenter/security/Content/
2001.10.04.html
http://www.microsoft.com/technet/treeview/default.asp?url=/tech
net/security/bulletin/MS01-050.asp

Given the strong potential for widespread abuse of this
vulnerability, we strongly recommend that you apply patches as soon
as you are able. For example, the Melissa virus which spread in
March of 1999 used social engineering to convince victims to
execute a macro embedded in a Microsoft Word document. For more
information, see the CERT/CC Advisory listed below.

http://www.cert.org/advisories/CA-1999-04.html

As a general practice, everyone should be aware of the potential
damage that Trojan horses and other kinds of malicious code can
cause to any platform. For more information, see

http://www.cert.org/advisories/CA-1999-02.html

This vulnerability has been assigned the identifier CAN-2001-0718
by the Common Vulnerabilities and Exposures (CVE) group:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0718

II. Impact

An attacker can execute arbitrary code on the target system with
the privileges of the victim running Excel or PowerPoint.

III. Solution

Apply a patch

Appendix A contains information from vendors who have provided
information for this advisory. We will update the appendix as we
receive more information. If a vendor's name does not appear, then
the CERT/CC did not hear from that vendor. Please contact your
vendor directly.

Until a patch can be applied, and as a general practice, we
recommend using caution when opening attachments. However, it is
important to note that relying on the "From" line in an electronic
mail message is not sufficient to authenticate the origin of the
document.

Appendix A. - Vendor Information

This appendix contains information provided by vendors for this
advisory. When vendors report new information to the CERT/CC, we
update this section and note the changes in our revision
history. If a particular vendor is not listed below, we have not
received their comments.

Microsoft Corporation

See Microsoft Security Bulletin MS01-050

Appendix B. - References

1. http://securityresponse.symantec.com/avcenter/security/Content/200
1.10.04.html
2. http://www.microsoft.com/technet/treeview/default.asp?url=/technet
/security/bulletin/MS01-050.asp
3. http://www.kb.cert.org/vuls/id/287067
4. http://www.cert.org/advisories/CA-1999-04.html
5. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0718
_________________________________________________________________
_________________________________________________________________

The CERT Coordination Center thanks Peter Ferrie and Symantec
Security Response, who discovered this vulnerability and published
the information in their advisory. Additionally, we thank
Microsoft Corporation, who published an advisory on this issue.
_________________________________________________________________

Author: Ian A. Finlay and Shawn V. Hernan.
______________________________________________________________________

This document is available from:
http://www.cert.org/advisories/CA-2001-28.html
______________________________________________________________________

CERT/CC Contact Information

Email: cert@cert.org
Phone: +1 412-268-7090 (24-hour hotline)
Fax: +1 412-268-6989
Postal address:
CERT Coordination Center
Software Engineering Institute
Carnegie Mellon University
Pittsburgh PA 15213-3890
U.S.A.

CERT/CC personnel answer the hotline 08:00-17:00 EST(GMT-5) /
EDT(GMT-4) Monday through Friday; they are on call for emergencies
during other hours, on U.S. holidays, and on weekends.

Using encryption

We strongly urge you to encrypt sensitive information sent by
email. Our public PGP key is available from

http://www.cert.org/CERT_PGP.key

If you prefer to use DES, please call the CERT hotline for more
information.

Getting security information

CERT publications and other security information are available from
our web site

http://www.cert.org/

To subscribe to the CERT mailing list for advisories and bulletins,
send email to majordomo@cert.org. Please include in the body of
your message

subscribe cert-advisory

* "CERT" and "CERT Coordination Center" are registered in the U.S.
Patent and Trademark Office.
______________________________________________________________________

NO WARRANTY

Any material furnished by Carnegie Mellon University and the
Software Engineering Institute is furnished on an "as is"
basis. Carnegie Mellon University makes no warranties of any kind,
either expressed or implied as to any matter including, but not
limited to, warranty of fitness for a particular purpose or
merchantability, exclusivity or results obtained from use of the
material. Carnegie Mellon University does not make any warranty of
any kind with respect to freedom from patent, trademark, or
copyright infringement.
_________________________________________________________________

Conditions for use, disclaimers, and sponsorship information

Copyright 2001 Carnegie Mellon University.

Revision History
October 8, 2001: initial release

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.8

iQCVAwUBO8H+YKCVPMXQI2HJAQHlegP+P6LyxsV880PLmLoip+dUJs6LcMER+t7r
uNU4MABB66f7B8pLNUTHI4cSzTdkH2mYC/fzdro92Z1t5VNTlMAQ3V27WP03OrU6
BdbduoHCXVWZMHYe1otl8ePPwPDwdYvajlEUoXSeG97Jl3pbA5wcCCvBdnRvhREr
gSzpV7t53FU=
=B68T
-----END PGP SIGNATURE-----

All rights reserved. Copyright© PakCERT 2000-2017