Flaw found in Office 2007
30082
Despite Microsoft's efforts to lock down the update, eEye finds a hole that could let an outsider run malicious software on a PC.
649561
(InfoWorld) - With its February security patches now two weeks away, Microsoft is warning of another critical flaw in its Office software. This time Excel is the target. Microsoft confirmed late Friday that its spreadsheet software is vulnerable to a new attack, and said that the problem may affect other Office software as well. The software giant is investigating reports that the flaw is being used by criminals in "very limited," attacks, according to a Microsoft security advisory. This latest flaw affects Microsoft Office 2000, Microsoft Office XP, Microsoft Office 2003, and Microsoft Office 2004 for Mac. Over the past year hackers have increasingly focused on Office applications as a security hole and the attacks based on these flaws are often the same: Criminals send an e-mail that appears legitimate, and trick unsuspecting users into opening a maliciously encoded document. Once the document is opened, attackers are able to install unauthorized software on the victim's system. Microsoft may not have time to patch the Excel flaw in time for its next set of security updates, expected Feb. 13, but, no doubt, it has other Office patches in the works. Over the past few months four similarly critical flaws have been reported in Microsoft Word. None of these has yet been patched.
271680
The latest version of Microsoft office for Macs incorrectly assigns ownership of some of its files when it's installed, causing a potential security problem for companies that are using the business suite.
363821
A critical flaw in Excel is attracting malware writers, says Microsoft, and the problem may affect other Office components as well.
219303
Microsoft is warning of a new unpatched vulnerability in its Word software.
655136
MS Office hijack hi-jinks An unpatched Microsoft Word 2000 vulnerability is being actively exploited by hackers to spread malware.â¦
598275
InfoWorld - When a hacker going by the name Chujwamwdupe published attack code that exploited a recently patched bug in Microsoft Office 2003 earlier this week, it looked almost as if he were publishing the software out of spite.
430768
Attackers are exploiting a vulnerability that lies within several versions of the Excel spreadsheet program, Microsoft warned late Tuesday.The problem in Excel allows a hacker to create a malicious Excel document that when opened can compromise a computer, Microsoft said in an advisory. The vulnerability could allow remote code to be executed on a computer, which means a user risks having their personal data exposed.Microsoft downplayed the risk, saying only targeted attacks have been seen. But since Microsoft Excel documents are commonly used for business, vulnerabilities such as this pose a greater risk.&quot;Users are familiar with the document being sent to them and are likely to open it,&quot; wrote security analyst Maarten Van Horenbeeck, in a commentary on the Web site for the SANS Internet Storm Center, which monitors Internet threats.The vulnerability is within the Microsoft Office Excel 2003 Service Pack 2, Microsoft Office Excel Viewer 2003, Microsoft Office Excel 2002, Microsoft Office Excel 2000 and the Mac version, Microsoft Excel 2004.Those who have installed Office Service Pack 3, which includes updates for Excel as well as other products in the office productivity suite, are not affected, Microsoft said. That service pack was released last September.Also not affected are Microsoft Office Excel 2007, Microsoft Office Excel 2007 Service Pack 1 and Microsoft Excel 2008 for the Mac.A PC user could be attacked a couple different ways. An e-mail with a malicious Excel attachment could be sent, upon which a user would have to download and open it to be exposed, Microsoft said. A hacker could also create a Web site hosting the file and try to persuade people to download it.Microsoft did not indicate when it would issue a patch for the problem. People who think they may have been attacked can contact Microsoft and their national law enforcement agency.
545850
Hackers are already exploiting a new vulnerability found in Microsoft's Word and Office applications, although the attacks appear to be limited.
708807
Blog: Researcher finds a basic cookie-handling error that could compromise Windows PCs.
715397
(InfoWorld) - Microsoft Corp. has released its monthly set of security patches, fixing a critical flaw in Office. Attackers could exploit the bug by tricking Office users into opening a maliciously encoded .pub document, which would then allow attackers to run unauthorized software on a victim's PC. These .pub documents are created by Microsoft's Publisher software, an Office component used for designing print and online business publications. The flaw isÂ described here. Microsoft rates the bug as critical for Publisher 2000, but this warning has been downgraded to "important" for the Publisher 2002 and Publisher 2003 products. Some security experts expected Microsoft toÂ fix a similar bug in Word, which has been used by online attackers over the past few weeks, but that problem remains unfixed. Microsoft acknowledged the Word problem last week and probably did not have time to run a fix through its quality assurance tests, said Jonathan Bitle, a manager of technical accounts with Qualys Inc. "It's really late in their engineering cycle, so it's understandable that they wouldn't manage to get something out," he said. Both the Word and Publisher bugs rely on the same type of attack to work: an attacker e-mails a malicious document and somehow tricks the victim into clicking on the attachment. Security experts have been seeing more of these Office flaws exploited of late. "This is one of the trends that we have observed," said Amol Sarwate, director of the Qualys vulnerability research lab. "The growing number of client-side vulnerabilities where you have a malformed Publisher file or Word file or Excel file." Tuesday's patches also include less-critical fixes for two Windows components: the PGM (Pragmatic General Multicast) protocol used by Microsoft's Reliable Multicast Program software to transfer data, and the Windows Indexing service, which is used by the operating system's search engine. Microsoft's security bulletins offer more information. September may seem likeÂ a bit of a reprieve for harried system administrators who were given 19 updates to test and deploy over the past two months. Microsoft was forced toÂ reissue one of its August patches after it caused Internet Explorer to crash when working with a Web-based enterprise applications such as PeopleSoft and Siebel. But before Microsoft patchers get too relaxed, they should brace for the possibility of another patch later this month, Qualys said. Because attackers are actively exploiting the Word problem, Sarwate believes that Microsoft may issue an "out-of-cycle" patch for the problem, ahead of its next scheduled security updates, which are due Oct. 10. Â
244785
Computer security firm Secunia has reported what it terms a "highly critical" vulnerability in the popular Microsoft (Nasdaq: MSFT) Word desktop computer application. The firm has confirmed the existence of the hole in versions of Word as recent as Word 2000.
722122
Security experts are reporting several new Windows and Internet Explorer vulnerabilities at year-end, including a flaw in the way Windows handles image files, and another involving IE and SP2 help files.
176052
Microsoft has issued a patch to fix the security flaw, and urges its customers to use a new utility to locate the computer applications that are vulnerable.
735768
After issuing seven patches as part of its monthly round of updates earlier this week, Microsoft recalled a fix for the Mac version of its Microsoft Office productivity suite. According to a posting on Microsoft's Security Response Center site, the updates were "accidentally published" before full testing was complete.
40132
Not just Windows - Mac too Microsoft has warned of a serious - and as yet unpatched vulnerability - in Word. Hackers (albeit to a limited extent) are exploiting the zero-day flaw in its ubiquitous Office application, Redmond warns.â¦
730366
SEATTLE - Microsoft has warned of seven newly found flaws in its software that could allow an attacker to steal data and take over a personal computer running the Windows operating system.