After that, the exploit's victim must open the booby-trapped Excel file. Security experts said that existing security holes facilitate the first step. Those attacks may be combined with this one to breach a system. Levy added that the DLL with hostile code could be accessed over the Internet as long as no firewall prevented the transfer. Microsoft's Internet applications usually warn people who download potentially hostile code.
Scripts are chunks of code that take actions on a computer automatically.
May. But Guninski's Excel exploit bypasses those kinds of warnings and restrictions. It should also be noted that many Web browsers, including Internet Explorer, default to opening links to MS Office files without asking the user whether they want to save the file or open it. A Microsoft representative said the company is working on a patch. The Excel problem under investigation today is the second that Guninski has demonstrated with the product this summer. That scenario could let a hostile file run as a local file with security clearance to do anything.