Security patch for Excel doesn’t add up

An Excel security patch issued by Microsoft is creating math problems, as a bug causes Excel to return zeroes instead of the correct number in certain cases.

The problem occurs only for some Excel users, and only when certain types of macros are run within the program, due to a bug in the MS08-014 patch, which was issued last week, IDG News Service reported.

In an online warning [1] posted March 13, Bill Sisk, Microsoft security response communications manager, said that the fixes outlined in the MS08-014 bulletin "causes Microsoft Excel 2003 calculations to return an incorrect result when a Real Time Data source is used."

In a security bulletin available on the Microsoft Web site [2], Microsoft said, "If you have applications that leverage Real Time Data sources in Visual Basic for Applications functions, we recommend that you perform additional testing before initiating a wide deployment of the update.”

Microsoft suggested that users run any function containing a Visual Basic macro that refers to a Real Time Data source on each cell individually, rather than on an array of cells. Microsoft is working on fixing the problem.

The MS08-014 update fixes a disclosed flaw in Excel that hackers had been exploiting in online attacks since mid-January, IDG reported.