Microsoft warns of new Word attack
530809
There&#8217;s now one more reason to be careful about opening Microsoft Office attachments.
408370
Microsoft Corp. announced Tuesday it has found a new security flaw with its Windows XP operating system and warned that an attacker could infiltrate other computers by persuading their owners to open a specialized graphics file.
560212
Microsoft Corp. is set to launch a  blistering attack on rival Google Inc.
252060
Microsoft blasts revelation of vulnerability in Word application.
16024
(InfoWorld) - Hackers have released attack code that exploits a critical vulnerability in Microsoft's Word software -- the thirdÂ such bugÂ to be disclosed in the past week. The proof of concept code was posted Tuesday on the Milw0rm.com Web site, making it widely available to the hacking community. It exploits a previously unreported bug in Word. Like the other recent Word bugs disclosed this past week, it could be used by attackers to run unauthorized software on a victim's computer, said David Marcus, security research and communications manager with McAfee Inc.'s Avert Labs Attackers have been using these Word exploits in extremely targeted attacks, where a small number of victims are sent an e-mail with a maliciously encoded Word document attached. The hackers useÂ social engineeringÂ techniques to try to trick the victim into opening the dangerous attachment. For example, in a recent Word attack, first reported Sunday, the malicious e-mail "was sent to a very high-profile company, directly to three people at the company," Marcus said. Microsoft is investigating reports of this latest Word bug, a spokesman for the company's public relations agency said. Though they are not being widely exploited, the unpatched Word vulnerabilities are causing some enterprises concern. At the Port of Seattle, for example, users are being cautioned and e-mail with Word attachments is getting a little more scrutiny, said Ernie Hayden, chief information security manager with the port. "We've done some blocking on our e-mail, and we've had dialogue with people with respect to what our expectations are," he said. Attacks on Microsoft's Office software have been on the rise for months now, said Marc Maiffret, chief technology officer with security vendor eEye Digital Security Inc. Office vulnerabilities were once released "on a monthly basis," he said. "Now we're at the point were it's almost daily." Still, publishing attack code ultimately works contrary to the interests of the bad guys, he added. "It's kind of disruptive, and it creates a panic," he said. "But all it does is make the industry focus and come up with a resolution."
424958
No end in sight Just when the world thought it was safe to resume use of Microsoft Office, there's word that a new zero-day attack may be targeting the popular productivity package. Like so many of the others, it's capable of all kinds of mischief, including the execution of malicious code on a victim's machine.â¦
655136
MS Office hijack hi-jinks An unpatched Microsoft Word 2000 vulnerability is being actively exploited by hackers to spread malware.â¦
112380
(InfoWorld) - One day after patching a widely exploited flawÂ in its Internet Explorer browser, Microsoft Corp. has a new bug to worry about, this time in PowerPoint. Attackers have been exploiting a newly discovered bug in Microsoft's Office presentation software in extremely targeted attacks, McAfee Inc. reported Wednesday. Researchers were made aware of the attacks when a customer submitted two different malicious PowerPoint files, both of which exploited the same vulnerability, said Craig Schmugar, a virus researcher at McAfee. Both files installed malicious remote access Trojan software that then attempted to connect to an outside Web server, he said. Though McAfee is not releasing technical details of the exploit, the security vendor says that it has confirmed that the attack works on three versions of Office running on the Windows 2000 operating system: Office 2000, Office XP, and Office 2003. Other platforms and other Office applications may also be affected, but McAfee has not yet had time to complete its testing, Schmugar said. Schmugar has blogged about the issueÂ  . Microsoft issued a security advisory on the matter Wednesday, saying that the issue affects users of Microsoft Office 2000, Microsoft Office 2003, and Microsoft Office XP, as well as Microsoft PowerPoint 2004 for Mac. Microsoft's advisory can beÂ found here. As a workaround, Microsoft suggests that users open and view files using PowerPoint Viewer 2003. This software "does not contain the vulnerable code and is not susceptible to this attack," the advisory states. The PowerPoint viewer can beÂ downloaded here. Microsoft and other security vendors, including Symantec Corp. and McAfee, have added signatures to their security products so that they can detect this malicious code. Over the past few months, attackers have focused on Office, exploiting a number of undisclosed Office bugs in extremely targeted attacks, often on government agencies or contractors. These attacks usually take the form of an e-mail that has a malicious Office document attached and is sent to a small number of target victims This latest PowerPoint attack fits that pattern and was sent to a defense contractor, Schmugar said. He declined to provide further details on the intended victim. Because the attack has been extremely limited in scope it is considered to be a low risk for most users, Schmugar said. News of the attack comes the day afterÂ Microsoft issued an emergency patch for a widely exploited bug that affected the VML (Vector Markup Language) rendering engine used by Internet Explorer and Outlook. Hackers are exploiting this critical flaw in the browser via mass e-mail and on thousands of Web sites, security experts said. Microsoft's next set of security patches will be released Oct. 10. The software vendor did not say whether it plans to patch this latest PowerPoint flaw.
171931
Microsoft Corp. is investigating yet another critical flaw in one of its products, this time in two versions of its popular word processing software, Microsoft Word 2000 and Word 2002.
292714
(InfoWorld) - There's now one more reason to be careful about opening Microsoft Office attachments. Microsoft warned Tuesday of a new, unpatched memory corruption error in its word-processing software, and said that it was investigating reports of "limited" attacks that exploit the problem. The bug can be exploited by adding a string of characters in a Word file that can corrupt the PC's memory and allow the attacker to run unauthorized software on the system, Microsoft wrote in a security advisory . The bug affects many versions of the software, including Word 2000, 2002, and 2003, the Word Viewer 2003 and several versions of Microsoft Works. It is rated 'critical' by the FrSIRT Web site, which compiles a list of software vulnerabilities. As automatic security updates have become commonplace, attackers have focused more on developing attacks that leverage this kind of unpatched hole in the software, sometimes called 0day attacks. This trend has forced Microsoft to produce a growing number of software updates in recent months. In particular, hackers turned their attention to Microsoft's Office products, which some researchers consider to be a more fruitful source of bugs than the Windows operating system. "Cyber criminals know that 0days are very vulnerable and can be used to make lots of money," said Cesar Cerrudo, chief executive officer of security research firm Argeniss, in Parana, Argentina. These vulnerabilities can be exploited to install spyware or dangerous Trojan horse programs, or to add the victim's computer to a network of compromised PCs, called a botnet, which can then be used to send out spam or attack other systems, he said. Microsoft's next set of security updates is due to be released on December 12.
689953
A recently detected exploit code foreshadows a likely worm-style attack on Windows machines plagued with the JPEG vulnerability made public last week, security experts said Thursday.
150857
Microsoft describes unpatched flaw that could corrupt PC memory and allow intruders.
67079
Microsoft Corp has released a patch for its latest âcriticalâ rated security flaw affecting its Windows, Office and developer tools software programmes.
375065
Microsoft has confirmed that criminals are e-mailing Word attachments that contain malicious code, with two vulnerabilities in the ubiquitous word-processing software now being exploited.
300614
On Tuesday, Microsoft warned its customers that several of its products are vulnerable to a flaw in the way they handle JPEG graphics images.
514325
Microsoft Corp. MSFT.O warned Windows  users on Tuesday of two new "critical"-rated security flaws in  its software that could allow attackers to take control of a  computer and delete or copy information.
163584
A tremendous amount of confusion has arisen in recent days over whether security firm Symantec actually discovered a new vulnerability in Microsoft Word three days ago, or simply uncovered a new exploit of an existing problem that Microsoft already acknowledged. In what appears to be an effort at backtracking, Symantec today appears to be saying both simultaneously.