Critical Flaw Discovered In MS Word
7285
According to an advisory published on security firm Secuniaâs website, a critical vulnerability exists in Microsoft Word, which can be exploited by a malicious code to cause a DoS (Denial of Service) and potentially compromise a user&#39;s system.
491983
commentary Microsoft was a little unhappy with an article I wrote this week because it contained a slight factual error. The error arose from two separate companies finding an almost identical security hole
271680
The latest version of Microsoft office for Macs incorrectly assigns ownership of some of its files when it's installed, causing a potential security problem for companies that are using the business suite.
112380
(InfoWorld) - One day after patching a widely exploited flawÂ in its Internet Explorer browser, Microsoft Corp. has a new bug to worry about, this time in PowerPoint. Attackers have been exploiting a newly discovered bug in Microsoft's Office presentation software in extremely targeted attacks, McAfee Inc. reported Wednesday. Researchers were made aware of the attacks when a customer submitted two different malicious PowerPoint files, both of which exploited the same vulnerability, said Craig Schmugar, a virus researcher at McAfee. Both files installed malicious remote access Trojan software that then attempted to connect to an outside Web server, he said. Though McAfee is not releasing technical details of the exploit, the security vendor says that it has confirmed that the attack works on three versions of Office running on the Windows 2000 operating system: Office 2000, Office XP, and Office 2003. Other platforms and other Office applications may also be affected, but McAfee has not yet had time to complete its testing, Schmugar said. Schmugar has blogged about the issueÂ  . Microsoft issued a security advisory on the matter Wednesday, saying that the issue affects users of Microsoft Office 2000, Microsoft Office 2003, and Microsoft Office XP, as well as Microsoft PowerPoint 2004 for Mac. Microsoft's advisory can beÂ found here. As a workaround, Microsoft suggests that users open and view files using PowerPoint Viewer 2003. This software "does not contain the vulnerable code and is not susceptible to this attack," the advisory states. The PowerPoint viewer can beÂ downloaded here. Microsoft and other security vendors, including Symantec Corp. and McAfee, have added signatures to their security products so that they can detect this malicious code. Over the past few months, attackers have focused on Office, exploiting a number of undisclosed Office bugs in extremely targeted attacks, often on government agencies or contractors. These attacks usually take the form of an e-mail that has a malicious Office document attached and is sent to a small number of target victims This latest PowerPoint attack fits that pattern and was sent to a defense contractor, Schmugar said. He declined to provide further details on the intended victim. Because the attack has been extremely limited in scope it is considered to be a low risk for most users, Schmugar said. News of the attack comes the day afterÂ Microsoft issued an emergency patch for a widely exploited bug that affected the VML (Vector Markup Language) rendering engine used by Internet Explorer and Outlook. Hackers are exploiting this critical flaw in the browser via mass e-mail and on thousands of Web sites, security experts said. Microsoft's next set of security patches will be released Oct. 10. The software vendor did not say whether it plans to patch this latest PowerPoint flaw.
230996
Blog: Microsoft revises one of its critical security bulletins from patch Tuesday, now including a fix for Microsoft Office 2004 for the Mac.
649561
(InfoWorld) - With its February security patches now two weeks away, Microsoft is warning of another critical flaw in its Office software. This time Excel is the target. Microsoft confirmed late Friday that its spreadsheet software is vulnerable to a new attack, and said that the problem may affect other Office software as well. The software giant is investigating reports that the flaw is being used by criminals in "very limited," attacks, according to a Microsoft security advisory. This latest flaw affects Microsoft Office 2000, Microsoft Office XP, Microsoft Office 2003, and Microsoft Office 2004 for Mac. Over the past year hackers have increasingly focused on Office applications as a security hole and the attacks based on these flaws are often the same: Criminals send an e-mail that appears legitimate, and trick unsuspecting users into opening a maliciously encoded document. Once the document is opened, attackers are able to install unauthorized software on the victim's system. Microsoft may not have time to patch the Excel flaw in time for its next set of security updates, expected Feb. 13, but, no doubt, it has other Office patches in the works. Over the past few months four similarly critical flaws have been reported in Microsoft Word. None of these has yet been patched.
342495
A flaw in the Microsoft programs that was announced on Sep 14, has already paved the way for a deluge of new security threats. The hackers have begun circulating malicious code hidden in images that use the popular JPEG format.
266105
Microsoft fixes a critical flaw in the Windows operating system that could be used by criminals to create a self-copying PC worm attack.
150857
Microsoft describes unpatched flaw that could corrupt PC memory and allow intruders.
708807
Blog: Researcher finds a basic cookie-handling error that could compromise Windows PCs.
647942
The effectiveness of a patch issued last September for a Microsoft Word vulnerability, where .DOC files opened in Word 2003 and earlier versions via Internet Explorer or Outlook could enable remote code execution, is being called into question today.
722992
On eve of Patch Tuesday, hackers jump Word segment of Microsoft Office in second attack.
163584
A tremendous amount of confusion has arisen in recent days over whether security firm Symantec actually discovered a new vulnerability in Microsoft Word three days ago, or simply uncovered a new exploit of an existing problem that Microsoft already acknowledged. In what appears to be an effort at backtracking, Symantec today appears to be saying both simultaneously.
545850
Hackers are already exploiting a new vulnerability found in Microsoft's Word and Office applications, although the attacks appear to be limited.
292714
(InfoWorld) - There's now one more reason to be careful about opening Microsoft Office attachments. Microsoft warned Tuesday of a new, unpatched memory corruption error in its word-processing software, and said that it was investigating reports of "limited" attacks that exploit the problem. The bug can be exploited by adding a string of characters in a Word file that can corrupt the PC's memory and allow the attacker to run unauthorized software on the system, Microsoft wrote in a security advisory . The bug affects many versions of the software, including Word 2000, 2002, and 2003, the Word Viewer 2003 and several versions of Microsoft Works. It is rated 'critical' by the FrSIRT Web site, which compiles a list of software vulnerabilities. As automatic security updates have become commonplace, attackers have focused more on developing attacks that leverage this kind of unpatched hole in the software, sometimes called 0day attacks. This trend has forced Microsoft to produce a growing number of software updates in recent months. In particular, hackers turned their attention to Microsoft's Office products, which some researchers consider to be a more fruitful source of bugs than the Windows operating system. "Cyber criminals know that 0days are very vulnerable and can be used to make lots of money," said Cesar Cerrudo, chief executive officer of security research firm Argeniss, in Parana, Argentina. These vulnerabilities can be exploited to install spyware or dangerous Trojan horse programs, or to add the victim's computer to a network of compromised PCs, called a botnet, which can then be used to send out spam or attack other systems, he said. Microsoft's next set of security updates is due to be released on December 12.
63129
According to the Microsoft site, the vulnerabilty in WordPad allows an attacker to âtake complete control of the affected systemâ.
350747
A typo in an official Microsoft e-mail is being blamed for rumors of an imminent Windows Vista service pack.