August 3, 1999 Web posted at: 11:55 a.m. EDT (1555 GMT) by Mary Lisbeth D'Amico

From...

(IDG) -- A security flaw has been discovered in Microsoft's Office 97 software that allows a hacker to delete files or manipulate data of an Office 97 user, Microsoft has confirmed.

The problem does not affect the new office software, Office 2000, according to information posted on a Microsoft Web site.

MORE COMPUTING INTELLIGENCE
	IDG.net home page
InfoWorld home page
InfoWorld forums home page
InfoWorld Internet commerce section
Get Media Grok and The Industry Standard Intelligencer delivered for free
Reviews & in-depth info at IDG.net
IDG.net's personal news page
Year 2000 World
Questions about computers? Let IDG.net's editors help you
Subscribe to IDG.net's free daily newsletter for IT leaders
Search IDG.net in 12 languages
News Radio
	Fusion audio primers
	Computerworld Minute

The weak point is an ODBC driver in Excel 97, the spreadsheet program for Office 97. A malicious hacker can create an Excel spreadsheet that exploits the weak point in this database driver, allowing him or her to delete files or "perform other malicious acts," according to Microsoft.

Office 97 users may become vulnerable by opening an infected spreadsheet attached to either an e-mail or Web site link, Microsoft said.

The security hole was brought to Microsoft's attention on July 27, Microsoft said. News reports said the flaw was discovered by Juan Carlos Cuartango, a Spanish software developer, but that could not be immediately confirmed.

Tomas Jensen, a Microsoft spokesman in Germany, confirmed that Microsoft has been aware of the problem since late last week, but could give no further information other than to say that Microsoft is working on it.

Microsoft is testing a solution, and said it will shortly post that on its Web site. For information on the security hole, see officeupdate.microsoft.com/Articles/MDAC_TYP.htm.