Requires Free Membership to View
"Microsoft is investigating new public reports of limited 'zero-day' attacks using a vulnerability in Microsoft Word XP and Microsoft Word 2003," the company said in an advisory published this week. "In order for this attack to be carried out, a user must first open a malicious Word document attached to an email or otherwise provided to them by an attacker."
The advisory offers tells customers how to run the flawed Word 2002 and Word 2003 programs in safe mode. Microsoft also listed the following guidelines for using Office documents in safe mode:
Targeted exploit code that takes advantage of Microsoft Word to open a backdoor for attackers was first reported in the wild late last week.
Cupertino, Calif.-based antivirus giant Symantec Corp. raised its ThreatCon level from 1 to 2 (on a scale of 4) as a result of the exploit, currently known as Trojan.Mdropper.H.
Symantec said the zero-day exploit arrives as a Word document attached to an email. The document appears to be of Japanese origin and includes text summarizing a recent U.S.-Asian political summit.
The document's OLE structure is a dropper program called Backdoor.Ginwui. Once a victim opens the document, that program creates a backdoor for attackers to exploit the system using a previously unknown vulnerability.
The software giant said it is completing a security bulletin for Word to address the vulnerability. "The security update is now being finalized through testing to ensure quality and application compatibility and is on schedule to be released as part of the June security updates on June 13, 2006, or sooner as warranted," Microsoft said.
This article originally appeared on SearchSecurity.com.
Join the conversationComment
Share
Comments
Results
Contribute to the conversation