Zero Day Word Flaw Exploited by Trojan

Via The Register UK -

Microsoft warns that an unpatched Word vulnerability has become the subject of targeted attacks.

The flaw - which is restricted to Microsoft Office Word 2002 Service Pack 3 - creates a mechanism for hackers to inject hostile code onto vulnerable systems. Redmond has published workarounds as a stop-gap measure while its researchers investigate the flaw in greater depth.

In the meantime, Microsoft is keen to downplay alarm. "At this time, we are aware of limited, targeted attacks attempting to use the reported vulnerability, but we will continue to track this issue," a post on its security response blog explains.

The vulnerability has appeared in a number of samples on malware. A widening number of anti-virus firms have issued signature updates to defend against the threat. Symantec, acting on samples sent to it by handlers at the SANS Institute's Internet Storm Centre, was the first to publish an advisory.

The timing of the arrival of the exploit means Microsoft had insufficient time to respond before its regular Patch Tuesday update, a factor that's unlikely to be a coincidence. The ins and out of the flaw are still under investigation and will probably be withheld until a fix is unavailable. It's also unclear who the attack is targeting, though historically unpatched Word exploits are a particular favourite of Chinese hackers.

-------------------------

According to Microsoft,

This vulnerability cannot be exploited on the following Microsoft Office software:

• Microsoft Office Word 2000 Service Pack 3
• Microsoft Office Word 2003 Service Pack 2 and Microsoft Office Word 2003 SP 3
• Microsoft Office Word 2007 and Microsoft Office Word 2007 Service Pack 1
• Microsoft Office Word Viewer 2003 and Microsoft Word Viewer 2003 Service Pack 3
• Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 1
• Microsoft Office for Mac 2004
• Microsoft Office for Mac 2008