Zero-Day Word Exploit Attacks from Asia Reported

Published: May 24, 2006

by Alex Woodie

A newly discovered security vulnerability in Microsoft Word is being exploited by attacks utilizing e-mail attachments to deliver a payload that could allow attackers to take control of the victims' computers, the SANS Internet Storm Center reported last week. Microsoft says it is working to fix the exploit, and will issue a patch on the next regularly scheduled patch release day, June 13, if not sooner.

SANS ICS reports that the zero-exploit appears to have originated in China or Taiwan, and that the payload has rootkit-like powers to cover its tracks, eludes antivirus detection, and can give the attacker total control over the affected system. However, the e-mail attacks utilizing this exploit are very targeted at this point, and are not widespread.

Few people have been sent infected Word attachments. However, Office users should be on their toes in case such attacks increase in frequency over the next three weeks before a patch is made available.

The new Word exploit is only being sent to those on the attackers target list, and it requires a user to open an infected message, which will somewhat lessen its ability to infect. However, because the e-mails are spoofed to appear to come from trusted sources within the victim's own company or organization, users may be tricked into opening them.

The zero-day exploit was the subject of a Microsoft security advisory published Sunday: See Microsoft Security Advisory 919637.