TITLE:
Microsoft Excel File Handling Code EXECUTION

SECUNIA ADVISORY ID:
SA28506

VERIFY ADVISORY:
HTTP://secunia.com/advisories/28506/

CRITICAL:
EXTREMELY critical

IMPACT:
System access

WHERE:
>From remote

SOFTWARE:
Microsoft Excel 2003
http://secunia.com/product/4970/
Microsoft Excel Viewer 2003
http://secunia.com/product/7700/
Microsoft Excel 2002
http://secunia.com/product/4043/
Microsoft Excel 2000
http://secunia.com/product/3054/
Microsoft Office 2000
http://secunia.com/product/24/
Microsoft Office 2003 Professional Edition
http://secunia.com/product/2276/
Microsoft Office 2003 Small Business Edition
http://secunia.com/product/2277/
Microsoft Office 2003 Standard Edition
http://secunia.com/product/2275/
Microsoft Office 2003 Student and Teacher Edition
http://secunia.com/product/2278/
Microsoft Office 2004 for Mac
http://secunia.com/product/8713/

DESCRIPTION:
A vulnerability has been reported in Microsoft Excel, which can be
exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an unspecified error in the
handling of Excel files and can be exploited via a specially crafted
Excel file with malformed header information.

Successful exploitation allows execution of arbitrary code but
requires that the user is tricked into opening a malicious Excel
file.

NOTE: According to Microsoft, this is CURRENTLY being actively
exploited.

The vulnerability is reported in the following versions:
* Microsoft Office Excel 2003 Service Pack 2
* Microsoft Office Excel Viewer 2003
* Microsoft Office Excel 2002
* Microsoft Office Excel 2000
* Microsoft Excel 2004 for Mac.

SOLUTION:
Do not open untrusted Excel files.

For Microsoft Excel 2003, the vendor recommends using the Microsoft
Office Isolated Conversion Environment (MOICE) or Microsoft Office
File Block policy. Please see the vendor's advisory for details.I have Office 2003 but I believe I'm safe. http://www.microsoft.com/technet/security/advisory/947563.mspx says: "At this time, our initial investigation indicates that customers who are using Microsoft Office Excel 2007 or Microsoft Excel 2008 for Mac, or who have installed Microsoft Office Excel 2003 Service Pack 3 are not affected by this vulnerability."

I have Service Pack 3 installed.