Microsoft updates Office Jet attack advisory

By

Microsoft has shed further light on last week's attacks on the Office Jet database component..

Microsoft updates Office Jet attack advisory
The company issued an update to its original security advisory, in which Microsoft Security Response Center manager Mike Reavey provided more information about the attack and how it differs from previous threats.

Security researchers had noticed that the attack exploits MDB files which Microsoft had previously deemed "unsafe" and attempts to shield itself from discovery.

Reavey explained that the attackers had found a new way to access the files, allowing them to hide the threat in a Word file.

"Everything changed with the discovery of this new attack vector that allowed an attacker to load an MDB file via opening a Microsoft Word document," wrote Reavey. "The previous guidance does not work against this new attack."

Reavey claimed that Microsoft has developed a new version of the MS Jet component which is protected from the attacks.

The updated component is already in use by Windows Vista and Server 2003. Windows XP SP3 will also contain a fix when it ships later this year. Office 2003 SP2 is also protected.

Reavey said that Microsoft is considering including a fix in a later security update. He also offered a couple of security tips.

"Enterprise administrators can block Jet files, even those renamed from MDB, at the gateway," he said.

"For end-users, we will continue to recommend that you never, ever open atta chments received unexpectedly."

Got a news tip for our journalists? Share it with us anonymously here.
Copyright ©v3.co.uk
Tags:

Most Read Articles

India's alarm over Chinese spying rocks CCTV makers

India's alarm over Chinese spying rocks CCTV makers

Hackers abuse modified Salesforce app to steal data, extort companies

Hackers abuse modified Salesforce app to steal data, extort companies

Woolworths' CSO is Optus-bound

Woolworths' CSO is Optus-bound

Cyber companies hope to untangle weird hacker codenames

Cyber companies hope to untangle weird hacker codenames

Log In

  |  Forgot your password?