Second Word zero day flaw found

Powered by SC Magazine
 

Microsoft may have to rethink patch Tuesday.

Microsoft has revealed a second zero-day flaw in Word, just days after a first vulnerability was found. 

Scott Deacon, from the Microsoft Security Response Centre, broke the news on his blog. 

The details on the second flaw are sketchy but Deacon said that it affects Word 2000, 2002, 2003 and Word Viewer 2003. Users of Word 2007 are safe.

"From the initial reports and investigation we can confirm that the vulnerability is being exploited on a very, very limited and targeted basis," wrote Deacon.

"We are tracking this issue through our Software Security Incident Response Process and as always, we will continue to monitor the situation and provide updates should the situation change or we become aware of new information."

The blog posting does not identify any change in Microsoft's stated plans not to include a patch for the first Word flaw in its regular patching cycle, due to be released on 12 December.

Graham Cluley, senior technology consultant at Sophos, said: "I am sure that Microsoft would like to get a patch out by Christmas, but it will be very tough.

"The flaws do not look too serious but the company will be anxious to avoid a repeat of last year when a WMF flaw left businesses vulnerable."

The WMF flaw was discovered just after Christmas last year. Microsoft was forced to rush out a patch ahead of schedule after attacks began appearing just six days later.

Copyright ©v3.co.uk


Second Word zero day flaw found
Tags
 
 
 
Top Stories
Five zero-cost ways to improve MySQL performance
How to easily boost MySQL throughput by up to 5x.
 
The big winners from Defence’s back-office IT refresh
Updated: The full list of subcontractors.
 
Tracking the year of CIO churn
[Blog post] Who shone through in 12 months of disruption?
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Which is the most prevalent cyber attack method your organisation faces?




   |   View results
Phishing and social engineering
  68%
 
Advanced persistent threats
  3%
 
Unpatched or unsupported software vulnerabilities
  11%
 
Denial of service attacks
  6%
 
Insider threats
  12%
TOTAL VOTES: 1006

Vote