You are currently offline, waiting for your internet to reconnect

XL97: Update Available for Excel CALL Vulnerability

This article was previously published under Q196791
This article has been archived. It is offered "as is" and will no longer be updated.
Microsoft has released an update for Microsoft Excel 97 that fixes avulnerability that could allow certain types of executables to be runwithout a warning to the user.

To correct this problem, download and install the latest update for Excel 97. The latest update includes this and all other Excel-specific updates that have been released since the latest service release (SR) of Office. The files included in this update will be included in any later SR or patch. To upgrade to the latest patch or for more information about the history of Excel 97 patches, please click the article number below to view the article in the Microsoft Knowledge Base:
232652 XL97: Overview and History of Excel Patches
A legitimate Excel function, CALL, allows executables to be run from aworksheet and could be used to run executables of a malicious nature. Afully supported update that disables this functionality is available. Theupdate works by disabling the CALL function on a worksheet, but does notdisable the CALL function from within macros. Microsoft recommends thatcustomers who need the CALL worksheet function evaluate the degreeof risk that it poses to their systems and determine whether the bestcourse of action is to apply the update.

This update is designed to update Microsoft Excel 97 Service Release 2 (SR-2). Microsoft does not currently have plans to provide a solution for the CALL vulnerability issue for earlier versions of Microsoft Excel. Because earlier versions of Excel do not provide full macro virus protection, disabling only the CALL worksheet function would not provide a significant level of safety as the CALL function can also be used in a macro.
More information
CALL is a legitimate, advanced function that calls an outside procedure ina dynamic-link library (DLL) or code resource. The DLL or code resourcecalled could contain code to perform potentially damaging or maliciousbehavior.

For example, using the CALL function in a workbook with the following syntax calls a DLL named Custom.dll containing a procedure named Test with a data type of Signed 4-byte integer:
   =CALL("Custom", "Test", "J!")				

Note that the exclamation point (!) makes the formula volatile,recalculating any time the worksheet changes.

In this example, the procedure named Test that is called can perform any type of operation including potentially damaging behavior. The CALLfunction simply executes this code which resides within the DLL. A customDLL is not part of Excel nor is it contained in the workbook.

The Call statement is used in a Visual Basic for Applications module sheet to call another macro located in the same workbook or transfer control to an intrinsic function, a dynamic-link library (DLL) procedure, or a procedure in a Macintosh code resource. This form of the Call statement cannot bypass the built-in macro virus protection.

This example illustrates how the Call statement can transfer control to a Sub procedure.
 Sub Main()    Call PrintToDebugWindow("Hello World")	    ' The above statement causes control to be passed to the    ' Sub procedure below. End Sub Sub PrintToDebugWindow(AnyString)    Debug.Print AnyString   ' Print to Debug window. End Sub				

Excel displays a warning before running macros, including those containing the Call statement, which allows you to decide whether or not to run them. However, Excel does not generate a warning before executing worksheet functions. Because the CALL function resides on the worksheet and not in a macro or module, you will not receive any warning when the workbook opens. The CALL function will then execute the intended procedure in a DLL or other code resource without warning.

How Does the Patch Work?

After you install the Excel 97 SR-2 CALL Function Update, no prompts oralerts will appear notifying you of the update. Everything will appear andfunction normally. However, when you use the CALL worksheet function oropen a workbook that contains the CALL function, the result will alwaysreturn the value FALSE. This indicates that the function is disabled and isnot functional.
For more information about the CALL function, click Contents and Index on the Help menu, click the Index tab in Excel 97 Help, type the following text
and then double-click the selected text to go to the "Call" topic. If you are unable to find the information you need, ask the Office Assistant.

Article ID: 196791 - Last Review: 10/26/2013 05:18:00 - Revision: 3.0

Microsoft Excel 97 Standard Edition

  • kbnosurvey kbarchive kbdtacode kbfix kbhowto kbpatch KB196791