However, numerous organisations have been targeted by exploits taking advantage of the word processor vulnerability, Eric Chien, Symantec researcher, said Thursday in a posting on the Symantec Security Response blog.
Chien said the flaw is being actively exploited in the wild, and advised customers to be careful opening Word email attachments.
The bug is a variation of a Microsoft Word flaw (CVE – 2006 -6456), revealed last year.
Chien first reported the flaw – and attacks exploiting it using the Mdropper.x trojan – on Tuesday.
A fourth Word flaw came to light last week, and is being used in limited attacks, according to Microsoft.
All of the vulnerabilities could be exploited to execute arbitrary code, allowing attackers to drop a trojan on an infected machine. Some experts predicted that Microsoft would release an out-of-cycle patch for the flaws, but so far Redmond has remained mum on its patching plans.
Click here to email Online Editor Frank Washkuch.
Microsoft tells Symantec that latest exploited Word flaw is variation of older vulnerability
By
Frank Washkuch
on
Feb 2, 2007 6:26PM
Microsoft has confirmed that what appeared to be a newly discovered Word flaw is actually a variant of a vulnerability revealed last year, according to Symantec.
Got a news tip for our journalists? Share it with us anonymously here.
Sponsored Whitepapers
Free eBook: Digital Transformation 101 – for banks
Why financial services need to tackle their Middle Office
Learn: The latest way to transfer files between customers
Extracting the value of data using Unified Observability
Planning before the breach: You can’t protect what you can’t see