Second Word zero day flaw found

By Iain Thomson on Dec 12, 2006 9:46 AM
Filed under Security

Microsoft may have to rethink patch Tuesday.

Microsoft has revealed a second zero-day flaw in Word, just days after a first vulnerability was found.

Scott Deacon, from the Microsoft Security Response Centre, broke the news on his blog.

The details on the second flaw are sketchy but Deacon said that it affects Word 2000, 2002, 2003 and Word Viewer 2003. Users of Word 2007 are safe.

"From the initial reports and investigation we can confirm that the vulnerability is being exploited on a very, very limited and targeted basis," wrote Deacon.

"We are tracking this issue through our Software Security Incident Response Process and as always, we will continue to monitor the situation and provide updates should the situation change or we become aware of new information."

The blog posting does not identify any change in Microsoft's stated plans not to include a patch for the first Word flaw in its regular patching cycle, due to be released on 12 December.

Graham Cluley, senior technology consultant at Sophos, said: "I am sure that Microsoft would like to get a patch out by Christmas, but it will be very tough.

"The flaws do not look too serious but the company will be anxious to avoid a repeat of last year when a WMF flaw left businesses vulnerable."

The WMF flaw was discovered just after Christmas last year. Microsoft was forced to rush out a patch ahead of schedule after attacks began appearing just six days later.