Russian New Year Exploit

SUMMARY

A network security firm announced the Russian New Year Exploit in early January 1999. This exploit is actually two different security risks combined. Computer systems can be configured or patched to prevent both security holes.

When viewing a Microsoft Excel spreadsheet (locally or remotely) using Internet Explorer or Netscape Navigator (prior to version 4.5), Microsoft Excel is launched automatically. Neither browser displays a confirmation dialog box before launching Microsoft Excel. This allows opening Microsoft Excel spreadsheets, which can contain macro viruses or other malicious code.

To enable your system to prompt whenever viewing any Microsoft Excel spreadsheets:

1. Double-click the My Computer icon.
2. Select View | Options or View | Folder Options depending on your operating system version. Select the File Types tab.
3. Scroll down the "Registered file types" window until you see Microsoft Excel.
4. For each entry, select Edit, and then verify "Confirm open after download" is selected. This should be done for each Excel type, which consists of all files with the XL? extension.
   
   Note: This same security risk occurs with Microsoft Word files. It is recommended the same procedure is done with all Microsoft Word file types.

The second security risk is the availability of CALL statements in Microsoft Excel spreadsheets. CALL statements allow referencing functionality in system DLLs. This allows performing potentially malicious tasks on your computer system when you open a Microsoft Excel spreadsheet. CALL statements can be included in macro sheets as well as in spreadsheet cells as a formula. Prior to the announcement of the Russian New Year exploit, Microsoft released a patch to disable the CALL functionality and can be found at:
http://officeupdate.microsoft.com/downloadDetails/xl97cfp.htm

A network security firm combined these two exploits and dubbed them the Russian New Year exploit because it is possible to direct a computer user to a Web site with a Microsoft Excel spreadsheet that contains malicious CALL statements. The computer user would not be warned before their computer system automatically launched Microsoft Excel and executed the malicious CALL statements.

Enterprises should also work with their firewall vendors to explore specific solutions to enable any network filtering of Microsoft Excel spreadsheets through HTTP.

There are no currently known Microsoft Excel spreadsheets that take advantage of this exploit. Any future threats using this technique will be easily handled by Norton AntiVirus.