XL97: Update Available for Excel CALL Vulnerability (196791)

MORE INFORMATION

CALL is a legitimate, advanced function that calls an outside procedure in a dynamic-link library (DLL) or code resource. The DLL or code resource called could contain code to perform potentially damaging or malicious behavior.

For example, using the CALL function in a workbook with the following syntax calls a DLL named Custom.dll containing a procedure named Test with a data type of Signed 4-byte integer:

   =CALL("Custom", "Test", "J!")
				

Note that the exclamation point (!) makes the formula volatile, recalculating any time the worksheet changes.

In this example, the procedure named Test that is called can perform any type of operation including potentially damaging behavior. The CALL function simply executes this code which resides within the DLL. A custom DLL is not part of Excel nor is it contained in the workbook.

The Call statement is used in a Visual Basic for Applications module sheet to call another macro located in the same workbook or transfer control to an intrinsic function, a dynamic-link library (DLL) procedure, or a procedure in a Macintosh code resource. This form of the Call statement cannot bypass the built-in macro virus protection.

This example illustrates how the Call statement can transfer control to a Sub procedure.

 Sub Main()
    Call PrintToDebugWindow("Hello World")	
    ' The above statement causes control to be passed to the
    ' Sub procedure below.
 End Sub

 Sub PrintToDebugWindow(AnyString)
    Debug.Print AnyString   ' Print to Debug window.
 End Sub
				

Excel displays a warning before running macros, including those containing the Call statement, which allows you to decide whether or not to run them. However, Excel does not generate a warning before executing worksheet functions. Because the CALL function resides on the worksheet and not in a macro or module, you will not receive any warning when the workbook opens. The CALL function will then execute the intended procedure in a DLL or other code resource without warning.

How Does the Patch Work?

After you install the Excel 97 SR-2 CALL Function Update, no prompts or alerts will appear notifying you of the update. Everything will appear and function normally. However, when you use the CALL worksheet function or open a workbook that contains the CALL function, the result will always return the value FALSE. This indicates that the function is disabled and is not functional.