Adrian here again.  Just wanted to post real quickly to let you know we’re looking into new public proof of concept code around a possible vulnerability in Microsoft Windows. So far we’re not aware of any attacks attempting to use vulnerability or any customer impact, but we wanted to let everyone know we’re investigating.

What we know at the moment is that the vulnerability can be attacked through Internet Explorer and requires user interaction on the page before the attack can occur.  As always, customers who believe they are affected can contact Product Support Services. You can contact Product Support Services in North America for help with security update issues or viruses at no charge using the PC Safety line (1866-PCSAFETY) and international customers by using any method found at this location: http://support.microsoft.com/security.

-Adrian

As many of you may know, there were some issues identified after the initial release affecting some users who required the use of legacy dial-up connections that use a terminal window, or dial-up scripting, or used scripts to change device configuration parameters. Additional details are covered in the bulletin and KB911280. If you are not affected by any of these scenarios or have installed the original update without any issues then you should not be impacted by the re-release.

We've had several questions regarding some recent issues that have affected Microsoft Excel over the last week. So, I thought I'd take a minute to review each, what the security impact could be for each issue, and what we're doing to resolve the issues.

We’re currently investigating three issues that have mentioned Microsoft Excel. The first one involves a vulnerability in Microsoft Excel itself. This issue has been assigned vulnerability identifier CVE-2006-3059. (The vulnerability identifiers are included within all of our security bulletins and security advisories and are a great way to help differentiate issues.) We released Security Advisory 921365 on Monday that has a full overview of this vulnerability, along with mitigations and workarounds. A couple key points - customers using Excel 2002 (included with Office XP) or Excel 2003 (included with Office 2003) will be warned before opening the attachment from an e-mail or a Web page, so remain careful when opening unsolicited files. Also, in the advisory there are instructions on how to modify the Access Control List (ACL) of a registry key that can block exploitation on Excel 2003. We've reached out to our partners in the MSRA and are sharing generic detection information for the vulnerability itself. The Office product team is currently testing updates that resolve the issue, and we expect to have it ready for release on or before July 11th.

Another issue was reported early this week that we discussed in the following post: http://blogs.technet.com/msrc/archive/2006/06/20/437826.aspx. This vulnerability has been assigned vulnerability identifier CVE-2006-3086. The vulnerability is in a Windows component, Hlink.dll, however it affects customers that open a specially crafted office document, and then click on a hyperlink within that document. Customers using Office XP or Office 2003 will get the same prompts as with CVE-2006-3059 when opening documents, so once again, being cautions when opening Office documents helps here as well. However, in our testing of the public posting we've seen that after the document is opened, for an attack to be successful, a user would still need to click on a link within that document and will be given a second prompt asking if the user does in fact intend on navigating to that destination. While the dialog doesn’t present a security-specific warning, the destination will include attack code, and does not look like a legitimate destination. So some social engineering would be required to make this attack successful. However, the fact that social engineering is required hasn’t stopped us from working quickly. We’re currently testing a fix for this issue and are investigating workarounds for customers.

The third was reported on Tuesday and that issue involves a method that allows an ActiveX control to be loaded within an Office document. The public posting on this has an example that involves an Excel document, so some folks may confuse this with the two issues above. This behavior is by design and by itself does not represent a security risk to customers. However, an attacker could use this functionality to automatically load a vulnerable ActiveX control already present on a user's system through an Office document. It is important to note that this is not a vulnerability and recent versions of Office respect the "Killbit" functionality of Windows that prevents vulnerable ActiveX controls from loading once they have received a kill bit through a Microsoft Security Bulletin. We're not aware of any vulnerable ActiveX controls that could allow remote code execution in this context or of attempts to use this method of attack or of customer impact at this time. We will continue to investigate the public reports to help provide additional guidance for customers as necessary.

--Mike

*This posting is provided "AS IS" with no warranties, and confers no rights.*

Hi everyone, Stephen Toulouse here.  We've see that detailed exploit code has been published on the Internet for the vulnerability addressed by Microsoft security bulletin MS06-025.  So per the usual when something like this happens so quickly after release we wanted to highlight that fact, and let you know that we're not currently aware of any active attacks utilizing this exploit code at this time.  But the MSRC is monitoring this situation to keep customers informed and to provide customer guidance as necessary.

We have confirmed that the exploit code does not affect users who have installed the update detailed in MS06-025 on their computers.  So we continue to recommend that customers apply the that update. In addition, We've posted a security advisory regarding this issue to provide additional guidance.  The security advisory can be found at the following location:

• http://www.microsoft.com/technet/security/advisory/921923.mspx

 We'll certainly keep an eye out on this issue and keep you posted if we see anything further.

S.

*This posting is provided "AS IS" with no warranties, and confers no rights.*

Hi everyone, Stephen Toulouse here.  Just posting a brief note about two quick things regarding the blog. 

When we originally set it up we used my user account and it's been our communal account for making posts.  Unfortunately every post showed up as from "stepto".  That's fixed now and posts will show up as being from "msrcteam".

Also we've added support for pingbacks and trackbacks!

S.

*This posting is provided "AS IS" with no warranties, and confers no rights.*

Hi everyone Christopher Budd here.

I wanted to give you some information about the recent posting of proof of concept PERL script that claims to demonstrate a vulnerability in Excel's processing of long links. As soon as we received these reports we immediately began an investigation into the posting. I wanted to let you know information we have based on that investigation.

First, I want to be clear that this proof of concept code and not an attack.  We’re not aware of any attacks based on this code based on our work with our Microsoft Security Response Alliance partners.

Second, our investigation so far has shown that while the posting claims this is a vulnerability in Excel, it actually is a vulnerability in hlink.dll which is a Windows component that handles operations involving hyperlinks. Any attempt to exploit this vulnerability would require convincing a user to open a specially-crafted Excel document. The user would then also have to locate and click on a specially-crafted long link in that document.  We have not found any way to attempt to exploit this vulnerability that involves simply opening a document: a user must locate a click a hyperlink in the document.

As a reminder, it’s important to make sure that you only accept and open files from a trusted source, as well as be careful what websites you visit.

It’s early into our investigation but we have our teams working hard on it. Once it’s complete, we’ll take the appropriate action to protect our customers based on our findings.

We’ll be closely monitoring the situation with our Microsoft Security Response Alliance partners for any changes. And, as always, we’ll provide updates through our blog as we have more information.

Christopher

*This posting is provided "AS IS" with no warranties, and confers no rights.*

Hi everyone, Mike Reavey here.  Just wanted to let you know we have posted our mitigations and workarounds researched throughout the weekend in the for of a security advisory.  It can be found here:

http://support.microsoft.com/kb/911280

Hey everyone, Mike Reavey here again.  We’re headed into the weekend and I wanted to check in and provide you with some more information about the Excel issue we are investigating.  As of right now it’s still just a single customer impacted.  But I want to reiterate that all of our various protection tools detect this malware and remove it.

The MSRC, together with the SWI team, have identified some workarounds that help stop the attack.  However we’re concerned that they might have an impact to the usability of Excel.  Based on some of the customer feedback regarding the recent Word workarounds, we want to take the extra time to fully vet our guidance. 

Of course, the Excel team is hard at work putting together the plan for an update as well. We’re working on an advisory through the weekend and will post it as soon as we are confident in the protection steps. 

- Mike

*This posting is provided "AS IS" with no warranties, and confers no rights.*