Zero day Word flaw exploited by Trojan

09-07-2008

by The Register

Microsoft warns that an unpatched Word vulnerability has become the subject of targeted attacks.

The flaw -- which is restricted to Microsoft Office Word 2002 Service Pack 3 -- creates a mechanism for hackers to inject hostile code onto vulnerable systems. Redmond has published workarounds as a stop-gap measure while its researchers investigate the flaw in greater depth.

In the meantime, Microsoft is keen to downplay alarm. "At this time, we are aware of limited, targeted attacks attempting to use the reported vulnerability, but we will continue to track this issue," a post on its security response blog explains.

The vulnerability has appeared in a number of samples on malware. A widening number of antivirus firms have issued signature updates to defend against the threat. Symantec, acting on samples sent to it by handlers at the SANS Institute's Internet Storm Centre, was the first to publish an advisory.

The timing of the arrival of the exploit means Microsoft had insufficient time to respond before its regular Patch Tuesday update, a factor that's unlikely to be a coincidence. The ins and out of the flaw are still under investigation and will probably be withheld until a fix is unavailable. It's also unclear who the attack is targeting, though historically unpatched Word exploits are a particular favourite of Chinese hackers.

The Register and its contents are copyright 2008 Situation Publishing. Reprinted with permission.