Microsoft tells Symantec that latest exploited Word flaw is variation of older vulnerability

By

Microsoft has confirmed that what appeared to be a newly discovered Word flaw is actually a variant of a vulnerability revealed last year, according to Symantec.


However, numerous organisations have been targeted by exploits taking advantage of the word processor vulnerability, Eric Chien, Symantec researcher, said Thursday in a posting on the Symantec Security Response blog.

Chien said the flaw is being actively exploited in the wild, and advised customers to be careful opening Word email attachments.

The bug is a variation of a Microsoft Word flaw (CVE – 2006 -6456), revealed last year.

Chien first reported the flaw – and attacks exploiting it using the Mdropper.x trojan – on Tuesday.

A fourth Word flaw came to light last week, and is being used in limited attacks, according to Microsoft.

All of the vulnerabilities could be exploited to execute arbitrary code, allowing attackers to drop a trojan on an infected machine. Some experts predicted that Microsoft would release an out-of-cycle patch for the flaws, but so far Redmond has remained mum on its patching plans.

Click here to email Online Editor Frank Washkuch.
Got a news tip for our journalists? Share it with us anonymously here.
Tags:

Most Read Articles

Phishing attack nets enormous npm supply chain compromise

Phishing attack nets enormous npm supply chain compromise

"VoidProxy" PhishKit targets Google and Microsoft users

"VoidProxy" PhishKit targets Google and Microsoft users

Apple adds "mercenary spyware" protection to new A19 chip

Apple adds "mercenary spyware" protection to new A19 chip

VicRoads to phase out passwords in favour of passkeys

VicRoads to phase out passwords in favour of passkeys

Log In

  |  Forgot your password?