Active exploits for flaw surface in the wild

Users and administrators are being warned about the emergence of a new attack targeting Excel.

Microsoft issued an advisory on Tuesday to warn users about the attacks, which target a flaw in the way code in Excel document files is handled. An attacker could use a specially-crafted Excel document to cause a crash and remotely execute code on a target system.

The company said that the early reports of attacks are not believed to be widespread. However, Microsoft warned that the flaw being targeted exists in more than six currently-supported versions of Office, including Office 2000, 2002, 2003, and 2007 for Windows as well as Office 2004 and 2007 for Mac OSX.

Microsoft confirmed that a fix for the flaw is in the works, but did not specify whether the patch will be released as an 'out of cycle' update or as a part of the next scheduled security update on 10 March.

In addition to warnings over the Excel attacks, Microsoft released an update which shores up security for the AutoRun feature in Windows 2000, XP and Server 2003 systems.

The company said that the update should fix errors which could prevent users from correctly disabling parts of the AutoRun feature on certain drives.

The update will allow users and administrators to edit the AutoRun registry key to disable one or all of the autorun functions to improve system security.