Comments on: Excel Vulnerability For Sale

By: Billkamm

Billkamm — Tue, 13 Dec 2005 14:27:00 +0000

#4, but you could use VBA with no API calls and write really malicious code if you wanted. That is why I was wondering if maybe there was some non-VBA way to run memmove() in Excel? Otherwise I don’t see the big deal. I must be missing something.

By: John Walkenbach

John Walkenbach — Sat, 10 Dec 2005 17:45:00 +0000

From The Register: eBay pulls Excel vulnerability auction

By: ross

ross — Sat, 10 Dec 2005 01:17:00 +0000

i would guess it’s a c API. I think what hes saying is that you could open an excel file and use the hole to excute your “malicious” code.

By: Billkamm

Billkamm — Fri, 09 Dec 2005 22:30:00 +0000

What is msvcrt.memmove()?

Would you need to call that via VBA code? If so I don't see this as a major problem, because if you allow macros you can do just about anything with the user's computer anyway.

Is there another way to access this function in Excel besides VBA? I feel I am missing something here.

By: doco

doco — Fri, 09 Dec 2005 04:17:00 +0000

I see this item has been removed from eBay…

By: doco

doco — Fri, 09 Dec 2005 04:15:00 +0000

"You may not use this information for malicious or illegal purposes. "

Yeah right. It's kind of like the gun law thing...