Microsoft Word Hole Could Allow DoS Attacks
244785
Computer security firm Secunia has reported what it terms a "highly critical" vulnerability in the popular Microsoft (Nasdaq: MSFT) Word desktop computer application. The firm has confirmed the existence of the hole in versions of Word as recent as Word 2000.
35029
Unpatched vulnerabilities may leave computers open to remote attacks.
71569
(InfoWorld) - Microsoft's Office software is under attack again, this time with anÂ unpatched flaw in the Windows 2000 version of Office 2000 being usedÂ by hackersÂ to run unauthorized software on a victim's computer. Microsoft confirmed on Tuesday that the bug exists, but it would not say when it plans to fix the problem. The critical vulnerability wasÂ first reported by SymantecÂ to users of its DeepSight threat notification service. Attackers are exploiting the flaw by sending malicious Word documents to victims, Symantec said. When these documents are opened, Word is tricked into installing malicious software on the PC. Symantec is calling this malware Trojan.MDropper. Trojan.MDropper installs malicious software on the computer, which in turn installs another Trojan horse program "which turns out to be new variant of Backdoor.Femo," Symantec said in an Web posting. Symantec testers had not been able to exploit the problem on more up-to-date versions of Office or Windows. On Tuesday Microsoft said that the bug was confined to Microsoft Word 2000. Microsoft is investigating the issue and may issue a patch once that investigation is completed, according to the company's public relations agency. Microsoft has spent a lot of timeÂ investigating and patching Office applications this year. Over the past few months there have been several reports concerning very targeted attacks, similar to this latest Office issue. Microsoft's last few security updatesÂ have been filled with patches for Office flaws, many of which had already been used in attacks.
520483
New computer code that exploits a recently disclosed hole in Microsoft&#39;s Internet Explorer Web browser is circulating on the Internet and could allow remote attackers to take full control of vulnerable Windows machines, according to warnings from
292714
(InfoWorld) - There's now one more reason to be careful about opening Microsoft Office attachments. Microsoft warned Tuesday of a new, unpatched memory corruption error in its word-processing software, and said that it was investigating reports of "limited" attacks that exploit the problem. The bug can be exploited by adding a string of characters in a Word file that can corrupt the PC's memory and allow the attacker to run unauthorized software on the system, Microsoft wrote in a security advisory . The bug affects many versions of the software, including Word 2000, 2002, and 2003, the Word Viewer 2003 and several versions of Microsoft Works. It is rated 'critical' by the FrSIRT Web site, which compiles a list of software vulnerabilities. As automatic security updates have become commonplace, attackers have focused more on developing attacks that leverage this kind of unpatched hole in the software, sometimes called 0day attacks. This trend has forced Microsoft to produce a growing number of software updates in recent months. In particular, hackers turned their attention to Microsoft's Office products, which some researchers consider to be a more fruitful source of bugs than the Windows operating system. "Cyber criminals know that 0days are very vulnerable and can be used to make lots of money," said Cesar Cerrudo, chief executive officer of security research firm Argeniss, in Parana, Argentina. These vulnerabilities can be exploited to install spyware or dangerous Trojan horse programs, or to add the victim's computer to a network of compromised PCs, called a botnet, which can then be used to send out spam or attack other systems, he said. Microsoft's next set of security updates is due to be released on December 12.
557341
(InfoWorld) - There's now one more reason to be careful about opening Microsoft Office attachments. Microsoft warned Tuesday of a new, unpatched memory corruption error in its word-processing software, and said that it was investigating reports of "limited" attacks that exploit the problem. The bug can be exploited by adding a string of characters in a Word file that can corrupt the PC's memory and allow the attacker to run unauthorized software on the system, Microsoft wrote in a security advisory . The bug affects many versions of the software, including Word 2000, 2002, and 2003, the Word Viewer 2003 and several versions of Microsoft Works. It is rated 'critical' by the FrSIRT Web site, which compiles a list of software vulnerabilities. As automatic security updates have become commonplace, attackers have focused more on developing attacks that leverage this kind of unpatched hole in the software, sometimes called 0day attacks. This trend has forced Microsoft to produce a growing number of software updates in recent months. In particular, hackers turned their attention to Microsoft's Office products, which some researchers consider to be a more fruitful source of bugs than the Windows operating system. "Cybercriminals know that 0days are very valuable and can be used to make lots of money," said Cesar Cerrudo, chief executive officer of security research firm Argeniss, in Parana, Argentina. These vulnerabilities can be exploited to install spyware or dangerous Trojan horse programs, or to add the victim's computer to a network of compromised PCs, called a botnet, which can then be used to send out spam or attack other systems, he said. Microsoft's next set of security updates is due to be released on December 12.
688722
Sample code that exploits a yet-to-be-fixed Windows flaw is circulating. Microsoft plans to deal with it on the next Patch Tuesday.
216335
A vulnerability in AOL's instant messenger could allow attacks. Also: A new Bagle variant rumbles across the Net.
305434
A vulnerability, which has been detected in Microsoft&#39;s flagship Internet Explorer, can be exploited by malicious users to conduct cross-site scripting attacks.
722992
On eve of Patch Tuesday, hackers jump Word segment of Microsoft Office in second attack.
189807
Browser flaw may leave you vulnerable to phishing attacks.
530742
Virus writers and hackers may be able to sidestep Microsoft's big fix.
88476
Two recently disclosed vulnerabilities that affect Internet Explorer 7 and Windows Vista could let hackers nab user data.
424958
No end in sight Just when the world thought it was safe to resume use of Microsoft Office, there's word that a new zero-day attack may be targeting the popular productivity package. Like so many of the others, it's capable of all kinds of mischief, including the execution of malicious code on a victim's machine.â¦
376456
Vulnerability, rated as highly critical, could enable an attacker to compromise a user's machine.
347238
Hole allows attackers to create fake Web sites that look genuine.
492082
Code could be used to crash PCs and ultimately commandeer them, security firms warn. But Microsoft hasn't confirmed the third Word flaw in two weeks.