Second Word zero day flaw found

Powered by SC Magazine
 

Microsoft may have to rethink patch Tuesday.

Microsoft has revealed a second zero-day flaw in Word, just days after a first vulnerability was found. 

Scott Deacon, from the Microsoft Security Response Centre, broke the news on his blog. 

The details on the second flaw are sketchy but Deacon said that it affects Word 2000, 2002, 2003 and Word Viewer 2003. Users of Word 2007 are safe.

"From the initial reports and investigation we can confirm that the vulnerability is being exploited on a very, very limited and targeted basis," wrote Deacon.

"We are tracking this issue through our Software Security Incident Response Process and as always, we will continue to monitor the situation and provide updates should the situation change or we become aware of new information."

The blog posting does not identify any change in Microsoft's stated plans not to include a patch for the first Word flaw in its regular patching cycle, due to be released on 12 December.

Graham Cluley, senior technology consultant at Sophos, said: "I am sure that Microsoft would like to get a patch out by Christmas, but it will be very tough.

"The flaws do not look too serious but the company will be anxious to avoid a repeat of last year when a WMF flaw left businesses vulnerable."

The WMF flaw was discovered just after Christmas last year. Microsoft was forced to rush out a patch ahead of schedule after attacks began appearing just six days later.

Copyright ©v3.co.uk


Second Word zero day flaw found
Tags
 
 
 
Top Stories
Beyond ACORN: Cracking the infosec skills nut
[Blog post] Could the Government's cybercrime focus be a catalyst for change?
 
The iTnews Benchmark Awards
Meet the best of the best.
 
Telstra hands over copper, HFC in new $11bn NBN deal
Value of 2011 deal remains intact.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  39%
 
Your insurance company
  3%
 
A technology company (Google, Facebook et al)
  8%
 
Your telco, ISP or utility
  7%
 
A retailer (Coles, Woolworths et al)
  2%
 
A Federal Government agency (ATO, Centrelink etc)
  20%
 
An Australian law enforcement agency (AFP, ASIO et al)
  14%
 
A State Government agency (Health dept, etc)
  6%
TOTAL VOTES: 1781

Vote
Do you support the abolition of the Office of the Information Commissioner?