Another Zero-Day Flaw Found in Word

Published: February 21, 2007

by Alex Woodie

Microsoft warned of a newly discovered security flaw in Word 2000 and Word 2002 that's being actively exploited on the Web. The vulnerability continues a recent spate of zero-day vulnerabilities in Office programs, mostly Word and Excel.

As the rest of the Windows-using world was busy last Tuesday applying a dozen patches that fixed 20 vulnerabilities across a range of products, Microsoft was getting ready to post an advisory on the newly discovered Word vulnerability. The company's TechNet Security group published Security Advisory 933052 last Wednesday to let people know it's aware of the problem and working on a fix.

"Very briefly, I wanted to let you know that we've posted a new advisory on a new Word issue," wrote Alexandra Huft on Microsoft's Security Response Center Blog!. "We've activated our Software Security Incident Response Process (SSIRP) and we are aware of . . . very limited, targeted attacks attempting to exploit this."

Microsoft has been hit by a string of zero-day vulnerabilities recently. Since mid-December, at least six security flaws have been discovered in Office. Making matters worse is the fact that hackers are rolling out exploit code simultaneous to the discovery of the vulnerability, which is what makes a zero-day vulnerability. The bad stretch has been tempered somewhat by the fact that none of the flaws have been exploited by mass-replicating vectors, such as worms or viruses. In most of the cases, users must be tricked into opening the malformed Word or Excel file to release Trojan code onto the computer.

Microsoft patched seven zero-day vulnerabilities in last Tuesday's round of patches. The new Word vulnerability is the only zero-day not currently patched, according to eEye Digital Security's Zero-Day Tracker.

RELATED STORIES

Microsoft Issues a Dozen Security Patches, Fixes Security Tools

Another Zero-Day Vulnerability Hits Office

                     Post this story to del.icio.us
               Post this story to Digg
    Post this story to Slashdot