Description of the Excel 2002 security update: October 12, 2004

A security vulnerability exists in Microsoft Excel 2002 that could allow arbitrary code to run when you open a maliciously modified spreadsheet. This vulnerability exists because of a problem in the way that Excel 2002 interprets data from a spreadsheet where certain properties have been maliciously modified. If successfully exploited, an attacker could craft a malicious spreadsheet that could cause code of the attacker�s choice to be executed automatically upon opening the maliciously modified spreadsheet. This update resolves this vulnerability so that Excel 2002 spreadsheets are handled appropriately.

For additional information about this security vulnerability, visit the following Microsoft Web site:

Security update details

List of issues that the security update fixes

The Excel 2002 security update: KB873366 fixes the issues that are described in the following hotfix package:

Installation details

How to obtain and install the security update

The security update, and also installation instructions and deployment strategies, are found on the Microsoft Download Center. To download this security update from the Microsoft Download Center, visit the following Microsoft Web site:

How to determine whether the security update is installed

The security update contains a file with the version that is listed in the following table:

   File name      Version
   --------------------------
   Excel.exe      10.0.6713.0

You do not have to install this security update if you have a later version of the file that is listed in this table.

For additional information about how to determine the version of Excel 2002 that is installed on your computer, click the following article number to view the article in the Microsoft Knowledge Base:

Information for administrators about .msp files

The security update is made up of a full-file Microsoft Windows Installer patch file (.msp file) that is packaged in a self-extracting executable file. The following .msp file is distributed in this security update:

Features for reinstalling specific components for administrators

If you update your administrative installation point and recache and reinstall Excel 2002 on client computers, you can run a command line that includes the REINSTALL=[list of features] property. This property specifies whether you want to reinstall specific components of Excel 2002 from the administrative image. For the Excel 2002 security update: KB873366, the value for list of features is as follows:Optionally, you can substitute the parameter REINSTALL=ALL to reinstall all Microsoft Office components on the client computer.

The Office Admin Update Center for Office IT Professionals contains the latest administrative updates and strategic deployment resources for all versions of Office. For more information about the Office Admin Update Center, visit the following Microsoft Web site:

Error signature details

When you use Excel 2002, you receive an error message that is similar to the following: When you view the data in the error report, the report contains an error signature that is similar to one of the following error signatures. These error signatures are fixed by the security update.

 Application name  Application version  Module name  Module version  Offset
 ----------------------------------------------------------------------------
 Excel.exe         10.0.6501.0          Excel.exe    10.0.6501.0     004e8879
 Excel.exe         10.0.6127.0          Excel.exe    10.0.6127.0     00228edd  
 Excel.exe         10.0.5815.0          Mso.dll      10.0.4219.0     00009ade  
 Excel.exe         10.0.5815.0          Excel.exe    10.0.5815.0     004d39a0  
 Excel.exe         10.0.4929.0          Excel.exe    10.0.4929.0     0030963c  
 Excel.exe         10.0.4524.0          Excel.exe    10.0.4524.0     004d337a  
 Excel.exe         10.0.4524.0          Excel.exe    10.0.4524.0     004d337f  
 Excel.exe         10.0.4302.0          Excel.exe    10.0.4302.0     004d327a  
 Excel.exe         10.0.4302.0          Excel.exe    10.0.4302.0     004d327f  
 Excel.exe         10.0.3506.0          Excel.exe    10.0.3506.0     004e5780  
 Excel.exe         10.0.2614.0          Excel.exe    10.0.2614.0     00707984  
 Excel.exe         10.0.2614.0          Excel.exe    10.0.2614.0     00707981  
 Excel.exe         10.0.2614.0          Excel.exe    10.0.2614.0     004e289a

Additionally, other program versions, module versions, and offsets are possible.