Second Word zero day flaw found

Powered by SC Magazine
 

Microsoft may have to rethink patch Tuesday.

Microsoft has revealed a second zero-day flaw in Word, just days after a first vulnerability was found. 

Scott Deacon, from the Microsoft Security Response Centre, broke the news on his blog. 

The details on the second flaw are sketchy but Deacon said that it affects Word 2000, 2002, 2003 and Word Viewer 2003. Users of Word 2007 are safe.

"From the initial reports and investigation we can confirm that the vulnerability is being exploited on a very, very limited and targeted basis," wrote Deacon.

"We are tracking this issue through our Software Security Incident Response Process and as always, we will continue to monitor the situation and provide updates should the situation change or we become aware of new information."

The blog posting does not identify any change in Microsoft's stated plans not to include a patch for the first Word flaw in its regular patching cycle, due to be released on 12 December.

Graham Cluley, senior technology consultant at Sophos, said: "I am sure that Microsoft would like to get a patch out by Christmas, but it will be very tough.

"The flaws do not look too serious but the company will be anxious to avoid a repeat of last year when a WMF flaw left businesses vulnerable."

The WMF flaw was discovered just after Christmas last year. Microsoft was forced to rush out a patch ahead of schedule after attacks began appearing just six days later.

Copyright ©v3.co.uk


Second Word zero day flaw found
Tags
 
 
 
Top Stories
Empty terminals and mountains of data
Qantas CIO Luc Hennekens says no-one is safe from digital disruption.
 
BoQ takes $10m hit on Salesforce CRM
Regulatory hurdles end cloud pilot.
 
Toll Group to go Google
Poaches Woolworths project manager.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  35%
 
Your insurance company
  5%
 
A technology company (Google, Facebook et al)
  9%
 
Your telco, ISP or utility
  8%
 
A retailer (Coles, Woolworths et al)
  4%
 
A Federal Government agency (ATO, Centrelink etc)
  18%
 
An Australian law enforcement agency (AFP, ASIO et al)
  15%
 
A State Government agency (Health dept, etc)
  7%
TOTAL VOTES: 3985

Vote
Do you support the abolition of the Office of the Information Commissioner?

   |   View results
I support shutting down the OAIC.
  27%
 
I DON'T support shutting the OAIC.
  73%
TOTAL VOTES: 1361

Vote