HTTP: Microsoft Excel Workbook Workspace Designation Handling Code Execution

This signature detects attempts to exploit a known memory corruption vulnerability in the way Microsoft Excel processes files. An attack targeting this can result in the injection and execution of code. If code execution is successful, the behavior of the target depends on the intention of the attacker. Any code injected is executed within the security context of the currently logged in user. In an unsuccessful attack, Excel terminates resulting in the loss of any unsaved data from the current session.

Extended Description

Microsoft Excel is prone to a remote code-execution vulnerability. Attackers may exploit this issue by enticing victims into opening a maliciously crafted Excel file (.xls). Successful exploits may allow attackers to execute arbitrary code with the privileges of the user running the application. This may facilitate a compromise of vulnerable computers.

Affected Products

Microsoft excel_2003

References

BugTraq: 24803

CVE: CVE-2007-3030

Short Name

HTTP:STC:DL:XLS-WORKSPACE-DES

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Microsoft Excel Workbook Workspace Designation Handling Code Execution

Extended Description

Affected Products

References

Found a potential security threat?