Vulnerability found in Microsoft Excel

A new vulnerability has been found in Microsoft's Excel spreadsheet program, just a few days after the company fixed problems with several of its applications in its monthly patch distribution.

One customer reported an attack using the vulnerability, which comes from an e-mail with a malicious Excel document attached, wrote Mike Reavey, Microsoft Security Program Manager, on the company's security blog.

The blog post did not give further details on what the malware does when downloaded. The blog post can be found at http://blogs.technet.com/msrc/archive/2006/06/16/436174.aspx.

Reavey noted that the e-mail application should prompt users to take care if they attempt to open the attachment. He cautioned against opening unsolicited documents, whoever they come from.

Microsoft has updated its own Windows Live Safety Center, a Web-based antivirus and performance improvement service now in beta release, to detect documents attempting to exploit the vulnerability, and also shared the information with security partners, Reavey wrote.

"We've got the Office team engaged of course, and they are hard at work investigating the vulnerability," Reavey wrote.

On Tuesday, Microsoft issued 12 updates for 21 vulnerabilities, one of the company's largest patch handouts for applications including Internet Explorer, Outlook Express, Word, PowerPoint and Windows Media Player.

Observers noted the patches affected mostly client-side applications. Of the 21 vulnerabilities, 19 could have allowed a hacker to gain remote control over a computer and possibly corrupt or steal data.