CVE:CVE-2007-0671
CNNVD:CNNVD-200702-013
Microsoft Excel是非常流行的电子表格处理办公软件。
Microsoft Excel处理畸形文件格式时存在漏洞，远程攻击者可能利用此漏洞通过诱骗用户打开恶意文件控制用户机器。
如果用户受骗打开了恶意的Excel文件的话，就可能导致执行任意代码。目前这个漏洞正在被名为Exploit-MSExcel.h的木马积极地利用。在打开畸形的XLS文件时会执行以下操作：
* 在内存中解压异或加密的shellcode
* 对于Windows XP Service Pack 2，使用硬编码的地址加载KERNEL32.DLL；对于其他Windows版本，Excel会崩溃 
* 使用API调用GetTempPathA和CreateFileA在%Temp%\top10.exe中创建新文件
* 使用API调用GetFileSize在内存中查找打开的XLS文件句柄，匹配特定的文件大小
* 从XLS文件中解压有效负载并写入%Temp%\top10.exe
* 执行%Temp%\top10.exe
<*链接：http://secunia.com/advisories/24008/
        http://www.avertlabs.com/research/blog/?p=191
        http://www.microsoft.com/technet/security/advisory/932553.mspx?pf=true
        http://vil.nai.com/vil/content/v_141393.htm
        http://www.microsoft.com/technet/security/Bulletin/ms07-015.mspx?pf=true
        http://www.us-cert.gov/cas/techalerts/TA07-044A.html
*>
solution:Upgrade microsoft access to a higher version than 2000,2002,2003,and avoid the version 2000,2002,2003; Upgrade microsoft excel to a higher version than 2000,2002,2003,2004,and avoid the version 2000,2002,2003,2004; Upgrade microsoft excel_viewer to a higher version than 2003,and avoid the version 2003; Upgrade microsoft frontpage to a higher version than 2000,2002,2003,and avoid the version 2000,2002,2003; Upgrade microsoft infopath to a higher version than 2003,and avoid the version 2003; Upgrade microsoft office to a higher version than 2000:sp3,2003:sp2,2004,xp:sp3,and avoid the version 2000:sp3,2003:sp2,2004,xp:sp3; Upgrade microsoft onenote to a higher version than 2003,and avoid the version 2003; Upgrade microsoft outlook to a higher version than 2000,2002,2003,and avoid the version 2000,2002,2003; Upgrade microsoft powerpoint to a higher version than 2000,2002,2003,2004,and avoid the version 2000,2002,2003,2004; Upgrade microsoft project to a higher version than 2000:sr1,2002:sp1,2003,and avoid the version 2000:sr1,2002:sp1,2003; Upgrade microsoft publisher to a higher version than 2000,2002,2003,and avoid the version 2000,2002,2003; Upgrade microsoft visio to a higher version than 2002:sp2,2003,and avoid the version 2002:sp2,2003; Upgrade microsoft word to a higher version than 2000,2002,2003,and avoid the version 2000,2002,2003; Upgrade microsoft word_viewer to a higher version than 2003,and avoid the version 2003