Sept. 3 — Microsoft issued another flock of security alerts Wednesday, including notice of a “critical” flaw affecting many of its Office applications. The most serious flaw, in the Visual Basic for Applications (VBA) software, could allow an attacker to gain control of a vulnerable PC. VBA is used to develop desktop applications that tie into other Microsoft products.
AS DETAILED in Microsoft’s security bulletin, a malicious user could create a document with a VBA application designed to overflow the buffer — the chunk of memory allocated to a program — and then run other code.
The flaw affects recent versions of Office applications that support VBA scripting, including the 2002, 2000 and 97 versions of Access, Excel, PowerPoint and Word. It can also be used with Project 2002 and 2000, Visio 2002 and 2000 and Works Suite 2002, 2001 and 2000. Several applications sold under Microsoft’s...