Microsoft Fixes Zero-Day Word Flaws
630318
Microsoft on Tuesday released a bevy of patches, including three critical patches for the Microsoft Windows operating system, two for Office, and a critical patch for its antivirus and anti-malware software products.
552648
An update to Office 2008 will address glitches in the installation process, Microsoft says.
673034
Microsoft said over the weekend that an issue with its Windows Genuine Advantage validation systems -- which were causing verified systems to fail and lose access to features -- had been fixed.
549959
Microsoft Corp. today released an unprecedented number of software security updates to plug flaws in its products, including seven &quot;critical&quot; defects that it said hackers could use to hijack
166796
Microsoft Corp. on Tuesday released 12 security fixes for its Windows operating system and Office business software.
146436
(InfoWorld) - Microsoft's Word and Office programs have been targeted again, with the company warning that hackers may already exploiting a new vulnerability found in the applications. The warning comes just afterÂ the company issued fixesÂ for 20 other bugs in its products on Tuesday, including six for Word. The latest problem affects Office 2000 and Office XP, Microsoft said in a security advisory on Wednesday. An attacker could create a specially-crafted Word document that, if opened, could allow them to control a victim's computer remotely. As usual it advised great caution when opening unsolicited attachments. Microsoft said it had received reports of "very limited, targeted" attacks. Danish security vendor SecuniaÂ ranked the problem as "extremely critical." The emergence of a security bug so soon after Microsoft's scheduled patch release follows a familiar pattern by hackers, who want to maximize the amount of time they have to take advantage of a vulnerability, said Thomas Kristensen, Secunia's chief technical officer. Microsoft rarely diverts from its patch schedule, set for the second Tuesday of the month, although it said it would in this case if it considers it necessary. Office applications such as Word are "low-hanging fruit" for hackers, since the programs haven't been audited as much as some others, such as Internet Explorer, Kristensen said. The hackers find a vulnerability by manipulating a document and testing how Word reads it. In this case, a modified document can corrupt system memory in a way that allows the attacker to execute code on the machine remotely. As well as sending the document via email, the hacker could embed it in a Web page and try to lure users into visiting that page. "Attacking using this vector is fairly easy," Kristensen said. However, new security features in Windows Vista, released to the general public last month, may prevent similar types of attack, so hackers may be making an extra effort to exploit them while they can, he said. Â
86995
Microsoft Corp. on Tuesday issued a trio of software updates to fix security holes in Windows computers, including one flaw that hackers are using to infiltrate PCs equipped with a massive security upgrade the company released just five months ago.
738931
In sharp contrast to last month&#39;s barrage of critical patches, Microsoft today offered up just one &quot;important&quot; fix for users to implement in its scheduled round of security updates for November.
460090
NOVEMBER 11, 2004  - In sharp contrast to last month&#39;s barrage of critical patches, Microsoft Corp. on Tuesday offered up just one &quot;important&quot; fix for users to implement in its scheduled round of security updates for November.
197018
An unpatched security vulnerability in popular older versions of Microsoft Word poses a severe threat to users, security reporting firm Secunia warned yesterday.
101397
Microsoft plans to release patches for five Windows flaws next week, the software giant announced Thursday. The company posted the information on its TechNet site as part of a new program that gives the general
17746
SEATTLE -- Microsoft released a patch for its latest &quot;critical&quot; rated security flaw affecting its Windows, Office and developer tools software programs, the company said Tuesday.
697888
"Extremely critical flaw" in Microsoft Word 2000, which has no released patch, could lead to remote execution of code.
625830
(InfoWorld) - MicrosoftÂ released its February set of security updates Tuesday, including critical fixes for bugs in Office and the scanning engine used by the company's security products. The security software flaw is of particular concern because it could, in theory, be very easily exploited by an attacker to run unauthorized software on a victim's PC. The bug has to do with the way that Microsoft's Malware Protection Engine, used by Windows Live One Care and Windows Defender, processes PDF files. Windows Defender is available for free and ships with Microsoft's Vista operating system. "An attacker could exploit the vulnerability by constructing a specially crafted PDF that could potentially allow remote code execution when the target computer system receives, and the Microsoft Malware Protection Engine scans, the PDF file," Microsoft said in its bulletin on the patch. This engine is also used by Microsoft's Antigen and Windows Forefront Security products, meaning that Exchange servers running these products could also be compromised. Although there is not yet any known attack that exploits this flaw, it could become a serious problem for Windows users running Microsoft's security products, according to Amol Sarwate, vulnerability lab manager at Qualys. "These attacks are very difficult to avoid," he said. "These products run automatically in the background." Symantec rated this scanning engine flaw the most critical of the vulnerabilities patched on Tuesday. In total, six of Microsoft's 12 updates are rated as "critical," while the other six have the less-serious rating of "important." Among the patches is a widely anticipated update for Microsoft WordÂ that fixes six bugs in Microsoft's word processing software. Hackers had been exploiting a number of these bugs in very targeted attacks over the past few months. Other critical patches fix bugs in the ActiveX HTML Help control and Microsoft Data Access Components, both used by Windows, as well as flaws in Office and Internet Explorer.
472677
Zero-day flaw, which is could let attacker gain remote access to a system, affects Word 2000, 2002 and 2003 and Word Viewer 2003.
688424
(InfoWorld) - Microsoft Corp. may be waiting until next month to patch a nasty bug in Outlook and Internet Explorer, but security researchers are offering users a more immediate option. A loose affiliation of security researchers going by the name of ZERT (Zeroday Emergency Response Team) has released a patch for the VML (Vector Markup Language) vulnerability, which increasingly is beingÂ exploited by criminals in malware attacks. Microsoft is scheduled to fix the bug on Oct. 10, the date it has set to release its monthly batch of security updates, but the company is under increasing pressure to release an earlier, "out-of-cycle" patch. On Friday the SANS Internet Storm CenterÂ raised its alert level from green to yellow, an indication that attacks are becoming more widespread. Microsoft has suggested a number of work-arounds to the problem, and the software vendor does not recommend that users install the ZERT patch, released Friday. "We think itâs great that there are people out there working to help protect our customers. But as we've always said, we cannot endorse third party updates," wrote Microsoft Security Response center program manager Scott Deacon in aÂ blog posting Friday. Microsoft's suggested work-around can be foundÂ here. Microsoft rigorously tests its patches to try to cut off any problems that the new software might introduce. The ZERT patch has not been widely tested and could introduce new problems when installed, security experts warn. ZERT plans to continue to release its own patches when particularly critical unpatched flaws begin to pose a "serious risk to the public, the infrastructure of the Internet or both," the group claims in a manifesto, published on itsÂ Web site . "The purpose of ZERT is not to 'crack' products, but rather to 'uncrack' them by averting security vulnerabilities in them before they can be widely exploited," the group says. ZERT sprang out of discussions on e-mail lists set up a few years ago by security researcher Gadi Evron, said ZERT member Randy Abrams, director of technical education with Eset LLC in San Diego. "Microsoft wants to assign a monthly patch and we understand that," said ZERT member Roger Thompson, who is chief technology officer with Atlanta's Exploit Prevention Labs Inc. "There's a certain benefit of staying on the monthly patch, but when things start to pop, as we think this VML thing is, there's a need to do something." The group's formation was spurred by Microsoft's WMF (Windows Metafile) vulnerability, which emerged in late 2005. Tens of thousands of Microsoft users downloaded third-party patches to fix that bug and Microsoft was eventually forced to release an out-of-cycle patch to address the problem. "This has been the first real vulnerability [since then] that the members have felt can be patched fairly quickly," Abrams said. Microsoft clearly does not want its users to get into the habit of installing third-party security patches, so if the ZERT software is widely downloaded, Microsoft may move more quickly with its own VML patch, Abrams said. "It might force Microsoft's hand on an out-of-cycle patch," he said
585935
Adobe Repairs Reader, Acrobat Flaws Information Week