Zero-Day Word Exploit Making the Rounds

Published: September 6, 2006

by Alex Woodie

A critical flaw in Microsoft Word 2000 is being actively exploited to enable hackers to take full control of effected Windows 2000 machines. Symantec, which reported the flaw first on Sunday, says the exploit requires users to open a maliciously crafted Word document, a route of infection that will keep the vulnerability from being exploited by a worm. Microsoft's next round of patches is due in less than a week, but will that give the vendor enough time to fix the problem?

Symantec says in its advisory that the new zero-day Word exploit is being taken advantage of by an existing Trojan, called MDropper.Q. First, it requires a user to open a maliciously crafted Word document, most likely spread via e-mail or downloaded from a Web site. The MDropper.Q Trojan then drops another Trojan, which in turn drops another file, which turns out to be a new variant of Backdoor.Femo, which was used to infect Office 2003 documents recently.

Danish security researcher Secunia labeled the new vulnerability as "extremely critical" in an advisory posted Tuesday. Meanwhile, the French Security Incident Response Team says in its advisory, also posted yesterday, that the flaw is the result of a memory corruption error in Word 2000.

Because documents incorporating the exploit code must be manually opened with a vulnerable copy of Microsoft Word 2000 to spread, the new vulnerability is unsuitable for the creation of self-replicating network worms, Symantec says. Just the same, the new exploit shows what a "great" platform Microsoft is for circulating malicious code, the Microsoft competitor explains.

"Microsoft Office vulnerabilities are a great platform for social engineering and e-mail-based attacks," Symantec says in its advisory. "As most of these document types are generally allowed to pass through most firewalls and security solutions, Microsoft Office documents are good vehicle for hiding executable malicious code."

Microsoft is reportedly looking into the newly discovered vulnerability, but, as of late Tuesday, has not publicly commented about the problems. In the past, the company has kept customers up-to-date about security problems and its intended actions through advisories on its TechNet Security site and through postings to its Microsoft Security Response Center Blog!

Microsoft has another day to figure out what it's going to do. The company, which is due to release its monthly round of patches next Tuesday, will list the patches to expect on its TechNet Security site tomorrow as part of its "early advisory" program.

RELATED STORIES

Zero-Day Word Exploit Attacks from Asia Reported

Get Your Patch On: 8 Critical Updates Issued by Microsoft