MS Excel XLM Text Macro execution fails to trigger warning when default medium security set

Overview

Excel fails to present a warning dialog when a macro is called from an external XLM (text macro) file.

Description

If a spreadsheet contains a reference to an external macro (XLM) file, Excel does not generate the usual warning dialog asking if the user wants to run the macro. Microsoft reports that the macros can not be automatically executed, and that the user must trigger the macro. It is possible that actions such as changing the cell focus are sufficient to trigger a macro however. The file types that may include a reference to an external macro include: comma separated values, tab delimited text, and data interchange format. Excel 97 and Excel 2000 have this vulnerability.

Microsoft has published a security bulletin with additional information at:

<http://www.microsoft.com/technet/security/bulletin/MS00-022.asp&gt;

---

Impact

Users may be tricked into executing an Excel macro, allowing the creator of the spreadsheet to execute arbitrary commands as the user opening the spreadsheet.

---

Solution

Apply a Patch

Microsoft has produced patches to correct this vulnerability. The patches are referenced in their advisory at:

<http://www.microsoft.com/technet/security/bulletin/MS00-022.asp&gt;

---

Set Macro Security Level to"High"

Setting the macro execution security level to “High”, will prevent the macros from running.

---

Vendor Information

26493

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Microsoft Corporation __ Affected

Updated: July 16, 2002

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Microsoft has published a security advisory on this topic at:

<http://www.microsoft.com/technet/security/bulletin/MS00-022.asp&gt;

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%2326493 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://www.microsoft.com/technet/security/bulletin/MS00-022.asp&gt;
• <http://www.microsoft.com/technet/security/bulletin/MS00-022.asp?a=printable&gt;
• <http://www.microsoft.com/technet/security/bulletin/fq00-022.asp&gt;
• <http://www.microsoft.com/technet/support/kb.asp?ID=255605&gt;
• <http://www.microsoft.com/technet/support/kb.asp?ID=255606&gt;
• <http://www.officeupdate.com/2000/downloadDetails/O2kSR1DDL.htm&gt;
• <http://www.officeupdate.com/downloadDetails/Xl8p9pkg.htm?s=/downloadCatalog/dldExcel.asp&gt;

Acknowledgements

Microsoft credits Darryl Higa for finding this vulnerability.

This document was written by Cory F. Cohen.

Other Information

CVE IDs:	CVE-2000-0277
Severity Metric:	4.01 Date Public: