Yet Another MS Word Flaw Surfaces
31400
On Sunday, Microsoft acknowledged the existence of another vulnerability in Word 2003, though declined to release details on the nature of this new find, other than to say it's different than the discovery of a heap overflow trigger last week by security research firm eEye.
40132
Not just Windows - Mac too Microsoft has warned of a serious - and as yet unpatched vulnerability - in Word. Hackers (albeit to a limited extent) are exploiting the zero-day flaw in its ubiquitous Office application, Redmond warns.â¦
67079
Microsoft Corp has released a patch for its latest âcriticalâ rated security flaw affecting its Windows, Office and developer tools software programmes.
470743
Less than zero-day September's Patch Tuesday leaves users waiting for a fix to defend against a zero-day exploit in Microsoft Word, targeted by malware authors over recent days.â¦
432126
A highly critical and unpatched security hole in Microsoft&#39;s ubiquitous Word software could be used to launch a denial of service attack and give system access.
625830
(InfoWorld) - MicrosoftÂ released its February set of security updates Tuesday, including critical fixes for bugs in Office and the scanning engine used by the company's security products. The security software flaw is of particular concern because it could, in theory, be very easily exploited by an attacker to run unauthorized software on a victim's PC. The bug has to do with the way that Microsoft's Malware Protection Engine, used by Windows Live One Care and Windows Defender, processes PDF files. Windows Defender is available for free and ships with Microsoft's Vista operating system. "An attacker could exploit the vulnerability by constructing a specially crafted PDF that could potentially allow remote code execution when the target computer system receives, and the Microsoft Malware Protection Engine scans, the PDF file," Microsoft said in its bulletin on the patch. This engine is also used by Microsoft's Antigen and Windows Forefront Security products, meaning that Exchange servers running these products could also be compromised. Although there is not yet any known attack that exploits this flaw, it could become a serious problem for Windows users running Microsoft's security products, according to Amol Sarwate, vulnerability lab manager at Qualys. "These attacks are very difficult to avoid," he said. "These products run automatically in the background." Symantec rated this scanning engine flaw the most critical of the vulnerabilities patched on Tuesday. In total, six of Microsoft's 12 updates are rated as "critical," while the other six have the less-serious rating of "important." Among the patches is a widely anticipated update for Microsoft WordÂ that fixes six bugs in Microsoft's word processing software. Hackers had been exploiting a number of these bugs in very targeted attacks over the past few months. Other critical patches fix bugs in the ActiveX HTML Help control and Microsoft Data Access Components, both used by Windows, as well as flaws in Office and Internet Explorer.
695012
"Limited attacks" are exploiting a previously unknown security bug in Microsoft Word, Microsoft warns.
234803
(InfoWorld) - Microsoft has released its monthly set of security patches, fixing a critical flaw in Office. Attackers could exploit the bug by tricking Office users into opening a maliciously encoded .pub document, which would then allow attackers to run unauthorized software on a victim's PC. These .pub documents are created by Microsoft's Publisher software, an Office component used for designing print and online business publications. The flaw isÂ described here. Microsoft rates the bug as critical for Publisher 2000, but this warning has been downgraded to "important" for the Publisher 2002 and Publisher 2003 products. Although Publisher is the application being patched, Office users should also be mindful of the issue because Publisher is part of the Office Professional Edition suite, said Christopher Budd, a program manager with Microsoft's Security Response Center. Some security experts expected Microsoft toÂ fix a similar bug in Word, which has been used by online attackers over the past few weeks, but that problem remains unfixed. Microsoft acknowledged the Word problem last week but was unable to run a fix through its quality assurance tests in time for September's updates, according to Budd. "It was just not feasible from an engineering standpoint ... to get the quality testing in," he said. Both the Word and Publisher bugs rely on the same type of attack to work: an attacker e-mails a malicious document and somehow tricks the victim into clicking on the attachment. Security experts have been seeing more of these Office flaws exploited of late. "This is one of the trends that we have observed," said Amol Sarwate, director of the Qualys Inc. vulnerability research lab. "The growing number of client-side vulnerabilities where you have a malformed Publisher file or Word file or Excel file." Tuesday's patches also include less-critical fixes for two Windows components: the PGM (Pragmatic General Multicast) protocol used by Microsoft's Reliable Multicast Program software to transfer data, and the Windows Indexing service, which is used by the operating system's search engine. Microsoft's security bulletins offer more information. September may seem like aÂ bit of a reprieveÂ for harried system administrators who were given 19 updates to test and deploy over the past two months. Microsoft was forced toÂ reissue one of its August patchesÂ after it caused Internet Explorer to crash when working with a Web-based enterprise applications such as PeopleSoft and Siebel. But before Microsoft patchers get too relaxed, they should brace for the possibility of another patch later this month, Qualys said. Because attackers are actively exploiting the Word problem, Sarwate believes that Microsoft may issue an "out-of-cycle" patch for the problem, ahead of its next scheduled security updates, which are due Oct. 10. That prospect seems unlikely, however. Microsoft's Budd characterized the Word attacks as "very limited in terms of scope," saying, "at this point in time, we've not made any determination to do anything out-of-cycle."
197018
An unpatched security vulnerability in popular older versions of Microsoft Word poses a severe threat to users, security reporting firm Secunia warned yesterday.
431571
Can computers get along fine without writers? Word is they just might. [Missing Link]
492063
Q: Last week I installed Microsoft Office 2007 and on the same day my spellchecker for outgoing messages in Outlook Express didn't recognize words like "you,""then," and "the," so I became suspicious.
655136
MS Office hijack hi-jinks An unpatched Microsoft Word 2000 vulnerability is being actively exploited by hackers to spread malware.â¦
292714
(InfoWorld) - There's now one more reason to be careful about opening Microsoft Office attachments. Microsoft warned Tuesday of a new, unpatched memory corruption error in its word-processing software, and said that it was investigating reports of "limited" attacks that exploit the problem. The bug can be exploited by adding a string of characters in a Word file that can corrupt the PC's memory and allow the attacker to run unauthorized software on the system, Microsoft wrote in a security advisory . The bug affects many versions of the software, including Word 2000, 2002, and 2003, the Word Viewer 2003 and several versions of Microsoft Works. It is rated 'critical' by the FrSIRT Web site, which compiles a list of software vulnerabilities. As automatic security updates have become commonplace, attackers have focused more on developing attacks that leverage this kind of unpatched hole in the software, sometimes called 0day attacks. This trend has forced Microsoft to produce a growing number of software updates in recent months. In particular, hackers turned their attention to Microsoft's Office products, which some researchers consider to be a more fruitful source of bugs than the Windows operating system. "Cyber criminals know that 0days are very vulnerable and can be used to make lots of money," said Cesar Cerrudo, chief executive officer of security research firm Argeniss, in Parana, Argentina. These vulnerabilities can be exploited to install spyware or dangerous Trojan horse programs, or to add the victim's computer to a network of compromised PCs, called a botnet, which can then be used to send out spam or attack other systems, he said. Microsoft's next set of security updates is due to be released on December 12.
530809
There&#8217;s now one more reason to be careful about opening Microsoft Office attachments.
388719
(InfoWorld) - Microsoft Corp. plans to patch its Windows and Visual Studio products next week, but it does not have a fix in the works for aÂ widely publicized flaw in Word, which hackers are reportedly exploiting in targeted attacks. The company's security team is readying five sets of patches for Windows, and will also issue a single critical security update for Visual Studio, Microsoft said in an alert published Thursday. Microsoft rates the most serious of its Windows updates as "critical," meaning an attacker could exploit the underlying flaw to run malware on a victim's PC with no user action, the company said. These security patches are usually released on the second Tuesday of each month, and the company strives to publish a small number of updates in December, because IT operations are often short-staffed during the holiday season. On Tuesday, Microsoft warned of a vulnerability in its Word software that had been reportedly used in online attacks. Security researchers rated this flaw critical, because an attacker could exploit it to run malicious software on a victim's PC. For such an attack to work, however, the victim would first have to be tricked into opening a maliciously encoded Word file. The Word flaw is not scheduled to be patched next Tuesday, said a spokesman for Microsoft's public relations firm. There is, however, one critical Visual Studio flaw that may be addressed in the updates. That bug is in Visual Studio 2005's WMI Object Broker ActiveX object. It was first reported in late October.
690752
A highly critical vulnerability has been discovered in Microsoft Word 2000 and 2002, an advisory from security advisory service Secunia says.
150857
Microsoft describes unpatched flaw that could corrupt PC memory and allow intruders.