Malicious code threatens MS software

Microsoft posted a warning to users last week that vulnerabilities in its Excel and PowerPoint office software could allow attackers to execute malicious code on a user's machine.

The vulnerability exists in the macro security framework, which basically scans a document for the presence of macros and asks a user if they want to run them.

The security measure was put in place because macros can be engineered to perform malicious actions. But a deliberately malformed macro can be inserted into a document, so that it bypasses the macro check and executes automatically.

The code could be written to perform any number of malicious actions on a victim's machine.

Microsoft also warned that the attack could come as a document sent via email, hosted on a website, or on a file share.

The vulnerability affects Microsoft Excel 2000 and 2002, and PowerPoint 2000 and 2002 for Windows and Mac, as well as Excel and PowerPoint 98 for Mac.

A patch is already available for vulnerable machines, here.