Attackers seize on new zero-day flaw in Word
545850
Hackers are already exploiting a new vulnerability found in Microsoft's Word and Office applications, although the attacks appear to be limited.
501384
The U.S. Computer Emergency Readiness Team released an alert yesterday saying that a flaw in the CryptoStor Tape 700 Series tape backup appliance could allow attackers to bypass one line of defense in a two-factor authentication system.
470743
Less than zero-day September's Patch Tuesday leaves users waiting for a fix to defend against a zero-day exploit in Microsoft Word, targeted by malware authors over recent days.â¦
557341
(InfoWorld) - There's now one more reason to be careful about opening Microsoft Office attachments. Microsoft warned Tuesday of a new, unpatched memory corruption error in its word-processing software, and said that it was investigating reports of "limited" attacks that exploit the problem. The bug can be exploited by adding a string of characters in a Word file that can corrupt the PC's memory and allow the attacker to run unauthorized software on the system, Microsoft wrote in a security advisory . The bug affects many versions of the software, including Word 2000, 2002, and 2003, the Word Viewer 2003 and several versions of Microsoft Works. It is rated 'critical' by the FrSIRT Web site, which compiles a list of software vulnerabilities. As automatic security updates have become commonplace, attackers have focused more on developing attacks that leverage this kind of unpatched hole in the software, sometimes called 0day attacks. This trend has forced Microsoft to produce a growing number of software updates in recent months. In particular, hackers turned their attention to Microsoft's Office products, which some researchers consider to be a more fruitful source of bugs than the Windows operating system. "Cybercriminals know that 0days are very valuable and can be used to make lots of money," said Cesar Cerrudo, chief executive officer of security research firm Argeniss, in Parana, Argentina. These vulnerabilities can be exploited to install spyware or dangerous Trojan horse programs, or to add the victim's computer to a network of compromised PCs, called a botnet, which can then be used to send out spam or attack other systems, he said. Microsoft's next set of security updates is due to be released on December 12.
695012
"Limited attacks" are exploiting a previously unknown security bug in Microsoft Word, Microsoft warns.
694818
According to the security company, the flaws mean that &quot;attackers can silently and remotely take over an SP2 machine when the user simply browses a web page&quot;.
197018
An unpatched security vulnerability in popular older versions of Microsoft Word poses a severe threat to users, security reporting firm Secunia warned yesterday.
615371
New versions of the MyDoom worm that began spreading late Monday afternoon are among the fastest-ever exploits of an unpatched Microsoft vulnerability, security experts said Tuesday.
647486
WinZip Computing warned last month of a security flaw in WinZip, its compression/decompression tool that runs on the Windows platform.
126756
Zero-day spectre haunts spreadsheets Microsoft has warned of an unpatched vulnerability in its Office productivity suite.â¦
492082
Code could be used to crash PCs and ultimately commandeer them, security firms warn. But Microsoft hasn't confirmed the third Word flaw in two weeks.
146436
(InfoWorld) - Microsoft's Word and Office programs have been targeted again, with the company warning that hackers may already exploiting a new vulnerability found in the applications. The warning comes just afterÂ the company issued fixesÂ for 20 other bugs in its products on Tuesday, including six for Word. The latest problem affects Office 2000 and Office XP, Microsoft said in a security advisory on Wednesday. An attacker could create a specially-crafted Word document that, if opened, could allow them to control a victim's computer remotely. As usual it advised great caution when opening unsolicited attachments. Microsoft said it had received reports of "very limited, targeted" attacks. Danish security vendor SecuniaÂ ranked the problem as "extremely critical." The emergence of a security bug so soon after Microsoft's scheduled patch release follows a familiar pattern by hackers, who want to maximize the amount of time they have to take advantage of a vulnerability, said Thomas Kristensen, Secunia's chief technical officer. Microsoft rarely diverts from its patch schedule, set for the second Tuesday of the month, although it said it would in this case if it considers it necessary. Office applications such as Word are "low-hanging fruit" for hackers, since the programs haven't been audited as much as some others, such as Internet Explorer, Kristensen said. The hackers find a vulnerability by manipulating a document and testing how Word reads it. In this case, a modified document can corrupt system memory in a way that allows the attacker to execute code on the machine remotely. As well as sending the document via email, the hacker could embed it in a Web page and try to lure users into visiting that page. "Attacking using this vector is fairly easy," Kristensen said. However, new security features in Windows Vista, released to the general public last month, may prevent similar types of attack, so hackers may be making an extra effort to exploit them while they can, he said. Â
113510
A group of software engineers who specialize in cracking code has delivered a patch for the new "zero day" flaw in Microsoft's Internet Explorer browser, beating Redmond to the punch in addressing the critical vulnerability.
313451
PDF attack prompts round-the-clock patch fest Escalating attacks exploiting a serious weakness in PDF files have prompted Microsoft to issue an all-hands-on-deck call to fix a vulnerability that lurks in the bowels of Windows XP.â¦
715236
Security researcher Petko Petkov has revealed a new zero-day flaw effecting Adobe's popular PDF format.
517744
A vulnerability that McAfee Avert Labs first warned about last week is now being exploited in the wild, according to VeriSign&#39;s iDefense. At issue are embedded objects in Rich Text Format (RTF) files.
715397
(InfoWorld) - Microsoft Corp. has released its monthly set of security patches, fixing a critical flaw in Office. Attackers could exploit the bug by tricking Office users into opening a maliciously encoded .pub document, which would then allow attackers to run unauthorized software on a victim's PC. These .pub documents are created by Microsoft's Publisher software, an Office component used for designing print and online business publications. The flaw isÂ described here. Microsoft rates the bug as critical for Publisher 2000, but this warning has been downgraded to "important" for the Publisher 2002 and Publisher 2003 products. Some security experts expected Microsoft toÂ fix a similar bug in Word, which has been used by online attackers over the past few weeks, but that problem remains unfixed. Microsoft acknowledged the Word problem last week and probably did not have time to run a fix through its quality assurance tests, said Jonathan Bitle, a manager of technical accounts with Qualys Inc. "It's really late in their engineering cycle, so it's understandable that they wouldn't manage to get something out," he said. Both the Word and Publisher bugs rely on the same type of attack to work: an attacker e-mails a malicious document and somehow tricks the victim into clicking on the attachment. Security experts have been seeing more of these Office flaws exploited of late. "This is one of the trends that we have observed," said Amol Sarwate, director of the Qualys vulnerability research lab. "The growing number of client-side vulnerabilities where you have a malformed Publisher file or Word file or Excel file." Tuesday's patches also include less-critical fixes for two Windows components: the PGM (Pragmatic General Multicast) protocol used by Microsoft's Reliable Multicast Program software to transfer data, and the Windows Indexing service, which is used by the operating system's search engine. Microsoft's security bulletins offer more information. September may seem likeÂ a bit of a reprieve for harried system administrators who were given 19 updates to test and deploy over the past two months. Microsoft was forced toÂ reissue one of its August patches after it caused Internet Explorer to crash when working with a Web-based enterprise applications such as PeopleSoft and Siebel. But before Microsoft patchers get too relaxed, they should brace for the possibility of another patch later this month, Qualys said. Because attackers are actively exploiting the Word problem, Sarwate believes that Microsoft may issue an "out-of-cycle" patch for the problem, ahead of its next scheduled security updates, which are due Oct. 10. Â