New zero-day Word attack emerges

By Tom Sanders on Feb 16, 2007 10:24 AM
Filed under Security

Attackers release exploit one day after Microsoft's monthly patch release.

Microsoft has issued a security alert concerning a new unpatched vulnerability in Word that is being actively exploited.

Attackers could exploit the vulnerability by persuading victims to open a specially crafted Word document. On infection, the attacker could take control of the victim's system.

The flaw affects Word 2000 and Word XP. Users are urged not to open any documents originating from unknown sources.

The attack comes 24 hours after Microsoft issued its monthly set of security patches, which contained three updates for the Office productivity suites.

Word and Excel vulnerabilities are popular with attackers targeting enterprise systems.

Numerous attacks have popped up in recent months in which criminals send out spam messages with a specially crafted Word or Excel document to a few key staff members inside one or a few organisations.

The attacks prey on business users' familiarity with Word and Excel applications, and allow the attackers to gain access to trade secrets or confidential customer information.

Launching small-scale attacks also limits the chances that a piece of malware is detected by security software, allowing the criminals to launch several raids before the security hole is plugged.