With Apple fans focused on the buzz surrounding Macworld this week, news of vulnerabilities and attacks that could wreak havoc on Apple users may be falling on distracted ears.
Security researchers are reporting two issues that Apple users need to hear about. The first is a Microsoft security advisory warning of a vulnerability in several versions of Microsoft Office Excel. This affects both Windows and Mac OS users. The second is a scareware program targeting Mac users.
New Office Software, Old Office Threats
For all the news about Microsoft Office 2008 for Mac, Apple fans, along with Windows users, may have a separate Office issue to deal with this week. Microsoft Office Excel 2003 Service Pack 2, Microsoft Office Excel Viewer 2003, Microsoft Office Excel 2002, Microsoft Office Excel 2000 and Microsoft Excel 2004 for Mac are affected by a new vulnerability.
The attack depends on a maliciously crafted Excel file that contains malformed header information. When a user attempts to open the file, either as an e-mail attachment or through a Web browser, the malformed header could corrupt system memory. That opens the door for an attacker to execute remote code on the victim’s machine or to get elevated user privileges.
“In a Web-based attack scenario, an attacker would have to host a Web site that contains a specially crafted Excel file that is used to attempt to exploit this vulnerability,” Microsoft said in an advisory.
“In addition, compromised Web sites and Web sites that accept or host user-provided content could contain specially crafted content that could exploit this vulnerability,” the advisory said. “An attacker would have no way to force users to visit these Web sites. Instead, an attacker would have to persuade users to visit the Web site, typically by getting them to click a link in an e-mail message or…