This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Suspicious Behavious excel.exe buffer overflow.

JAZZIE over 8 years ago

Sophos has recently started detecting buffer overflows for various versions of MS Excel for multiple clients

Has anyone else experienced this and know what has suddenly caused this too happen? Sophos or Windows Updates.....?

Regards

Jeff

This thread was automatically locked due to age.

0 jbr314 over 8 years ago

Interesting! I just posted a on going problem with MS Outlook's attachements getting the same treatment. Did you ever get any help from anyone?
:57783
Cancel
Vote Up 0 Vote Down

Cancel
0 JAZZIE over 8 years ago

Unfortunately no yet.
We have a large number of clients using our MSP Sophos and thought it would have been a common problem. Obviously not.
:57786
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 8 years ago

Hello JAZZIE and jbr314,
there has been a "Compatibility with EMET" issue resulting in Buffer Overflow alerts - but this should no longer be the case with Endpoint 10.3.12 and above.
@jbr314: Is this endpoint really running 10.0 and not 10.3?
Christian
:57792
Cancel
Vote Up 0 Vote Down

Cancel
0 DarrenTeagles over 8 years ago

If it is 10.0 rather than 10.3.x then you should upgrade ASAP as 10.0 is no longer supported even though it is still available. If you are running 10.3.x we could do with knowing the version of Excel, has it changed recently and also, is there a possibility of a macro within it that is cauing the overflow?
:57796
Cancel
Vote Up 0 Vote Down

Cancel
0 Patrick Do over 7 years ago

We have client version 10.6 and still getting this same error. Not sure to do with this alert.
Cancel
Vote Up 0 Vote Down

Cancel
0 Long Road SFC ITServices over 7 years ago in reply to Patrick Do

We have also seen one incidence of this error, on Excel 2010 version 14.0.7179.5000, Sophos version 10.6.4 VE3.67.3 and Windows 7 Pro with SP1 and updates.

Does it happen because of a malicious spreadsheet, or is it an Excel patch that is missing from the PC?

Dan Jackson (Lead ITServices Technician)

Long Road Sixth Form College

Cambridge, UK
Cancel
Vote Up 0 Vote Down

Cancel
0 Blood over 6 years ago in reply to Long Road SFC ITServices

We have seen this on one endpoint this week.

Microsoft Excel 2013 15.0.4989.1000 32bit on a 64bit Win7 Pro SP1 patched system. Sophos AV 10.7.2 VE3.69.2

"Suspicious behavior Threat type not cleanable Buffer Overflow C:\Program Files (x86)\Microsoft Office 2013\Office15\EXCEL.EXE"

I spoke to the person who uses this machine and they stated they had not used Excel.

Any further info on this?

I have not seen it flagged on any other endpoint (35 systems).

Cheers!
Cancel
Vote Up 0 Vote Down

Cancel
0 David Dewar over 6 years ago in reply to Blood

I have also seen it affect Outlook with Sophos Version 10.7

User on a Win7 64bit

C:\Program Files (x86)\Microsoft Office\Office15\OUTLOOK.EXE

Threat type - Suspicious behavior

Threat Name - Buffer Overflow

Action Taken - Blocked
Cancel
Vote Up 0 Vote Down

Cancel
0 DESIT over 6 years ago in reply to David Dewar

This is exactly the message I have seen on some of our VMs in the last few days.
Is this possibly connected with Spectre/Meltdown or is there really something going on?
Cancel
Vote Up 0 Vote Down

Cancel