Microsoft Issues Word Zero-Day Attack Alert

By Ryan Naraine Print this article Print

Updated: The unpatched flaw can be exploited when a user merely opens a rigged Word document, and there are no pre-patch workarounds available, Microsoft warns.

Microsoft on Dec. 5 warned that an unpatched vulnerability in its Word software program is being used in targeted, zero-day attacks.

A security advisory from the Redmond, Wash., company said the flaw can be exploited if a user simply opens a rigged Word document.

Affected software versions include Microsoft Word 2000, Microsoft Word 2002, Microsoft Office Word 2003, Microsoft Word Viewer 2003, Microsoft Word 2004 for Mac and Microsoft Word 2004 v. X for Mac. The Microsoft Works 2004, 2005 and 2006 suites are also affected because they include Microsoft Word.

For advice on how to secure your network and applications, as well as the latest security news, visit Ziff Davis Internet's Security IT Hub.

There are no pre-patch workarounds available. Microsoft suggests that users "not open or save Word files," even those that arrive unexpectedly from trusted sources. "As a best practice, users should always exercise extreme caution when opening unsolicited attachments from both known and unknown sources," the company said.

Users who have installed and are using the Office Document Open Confirmation Tool for Office 2000 will be prompted with Open, Save or Cancel before a file is opened. This offers a minor warning mechanism for Word users.

The high-risk alert comes exactly one week before the company's scheduled December Patch Tuesday, but there is no word yet from Microsoft on the timing of its fix for Word.

Click here to read about zero-day attacks against Microsoft Office Excel.

The MSRC (Microsoft Security Response Center) has activated its incident response process, which includes coordination with anti-virus and security vendors and the creation of a software update. According to the advisory, Microsoft may consider an out-of-cycle patch if necessary.

At press time on Dec. 5, there were no detection signatures available from anti-virus vendors.

This is the second major Microsoft Word zero-day attack this year. In May 2006, a sophisticated attack originating from China and Taiwan was detected using a Trojan dropper and a backdoor with rootkit features to mask itself from anti-virus scanners.

There have been several zero-day flaws—and targeted attacks—found in Microsoft Office applications, including Excel, PowerPoint and Publisher. Many security experts said they believe corporate espionage is the main motive behind the attacks.

Editor's Note: This story was updated to clarify Microsoft's guidance on the opening of Word documents from trusted sources.

Check out eWEEK.com's Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at Ryan Naraine's eWEEK Security Watch blog.

This article was originally published on 2012-05-04
eWeek eWeek

Have the latest technology news and resources emailed to you everyday.