MS Excel 2007,2010,2013,2016 OLE Remote Code Execution Vulnerability

MS Excel contains a remote code execution vulnerability upon processing OLE objects. Although this is a different issue from the 
MS Word HTA execution vulnerability, it has been patched together, 'silently'. By performing some tests from the Word HTA PoC posted
on exploit-db[dot]com, its possible to exploit it through Excel too, however the target would need to either accept a security warning
regarding external links or double click inside the Excel window, same applies for Powerpoint, so I guess this is the reason, Word caught
the attention and no exploit PoC was made available to other Office apps.

This vulnerability exists in the way Excel handles parameters passed to the "DDEService" attribute of links, leading to the search for a 
program to display it. As it does not impose restrictions on what program is going to be executed, for instance, only programs located in the
Office install directory, it is possible to invoke arbitrary local programs with parameters, leading to system compromise.
Since Excel blocks automatic update of linked files, the target must be tricked into double clicking anywhere inside the document. 
(The linked object occupies basicly the whole document window). Without the patch applied no warning/prompt is shown;
With the patch a prompt is shown asking if its ok to run 'xxxx.exe', where 'xxxx.exe' can have arbitrary names as long as its at most 8 
chars long, so we could still fake/spoof it as another Office app (the app name cannot be the same of the legitimate, eg. 'Excel').

a POC is provided, attached as 'Excel_PoC.zip.txt'. Please remove the '.txt' extension to open the ZIP archive.

Successfully tested on:

MS Windows 10/8.1/8.0/7/Vista/Server 2008/Server 2012. (Server 2016 likely vulnerable) x86 and x64.
MS Office 2007,2010,2013,2016 fully patched up to the Microsoft March 2016 patch.



