Microsoft refutes exploit-site reports of Office flaws

The hacker, using the moniker "Muts," said he found a number of file format bugs in just three hours. He acknowledged the bugs on the Milw0rm and Security Vulnerabilities websites.

However, a Microsoft spokesman said the company is investigating the reports initial inquiries have found no flaws in Word 2007 or Office 2007. The investigation is ongoing, according to the spokesperson.

Microsoft is not aware of any attacks targeting the reported flaws, the spokesperson said.

On Tuesday, Microsoft released five fixes for eight server- and client-side vulnerabilities that could lead to attackers executing arbitrary code.

The most pressing fix released was MS07-021, which fixes a privilege escalation flaw in Microsoft Client/Server Runtime Server Subsystem (CRSSS) and affects all operating system versions, including Vista.

Last Tuesday, Microsoft released an emergency,  out-of-cycle patch for a vulnerability in the way Windows handles ANI files, a flaw being exploited by thousands of malicious sites.

Amol Sarwate, director of Qualys’ vulnerability research lab, told SCMagazine.com today that exposure of flaws around Patch Tuesday has become the norm in recent months.

"No, this is not really unusual. What we have seen the past few Patch Tuesdays is that there are vulnerability announcements right before and right after so it gives hackers very little time to react," he said.

<

flawsmicrosoftofofficereportssecurity