eBay stops illegal sale of Excel flaw

12 December 2005 9:06 GMT / By Stuart Miles

Online auction house eBay has pulled an auction in which the highest bidder would have won information on how to exploit an alleged flaw in Microsoft's Excel spreadsheet application.

The flaw could allow a malicious programmer to remotely take control of a Windows based PC if the owner of the program opens a specific spreadsheet.

"The listing was immediately reviewed and pulled from the site for violating our policy against promoting illegal activity - hacking", Catherine England, spokeswoman for the online auctioneer said in an email to SecurityFocus, a source of security information on the Internet.

"In general, research can be sold as a product. However, if the research were to violate the law or intellectual property rights then it would not be allowed".

The company removed the listing after being alerted to it by Microsoft.

The listing stated:

“Up for sale is one (1) brand new vulnerability in the Microsoft Excel application. The vulnerability was discovered on December 6th 2005, all the details were submitted to Microsoft, and the reply was received indicating that they may start working on it. It can be assumed that no patch addressing this vulnerability will be available within the next few months. So, since I was unable to find any use for this by-product of Microsoft developers, it is now available for you at the low starting price of $0.01 (a fair value estimation for any Microsoft product)”.

The listing went on to say:

“The winning bidder must provide an e-mail address that accepts .xls attachments. Two xls files will be mailed to this e-mail address: one file is the original Microsoft Excel document, the other one is a copy of the same document modified to demonstrate the vulnerability. The demonstration merely triggers the exception causing Excel to crash. It does not do anything malicious. A detailed de ion of the vulnerability will be provided in the message body. At that time you can claim youself to be THE ONLY ONE IN THE WORLD possessing the knowledge about the vulnerability. Wow! Imagine that! (Well, not counting Microsoft, but I really doubt that they'll share it with anyone.) It is up to you what to do with it, but you may not use it for malicious purposes”.

Image and listings copy via http://www.osvdb.org/blog/

Full tags

Software, Online, eBay, Microsoft, shopping