Patched Microsoft Word exploit hits the wild

By

Virus writers are actively exploiting a memory corruption vulnerability in Microsoft Word that was patched on Tuesday, researchers said today.

Patched Microsoft Word exploit hits the wild
The flaw, which, according to Microsoft, was being exploited in targeted attacks prior to Tuesday's fix, is rated "extremely critical" by vulnerability tracking firm Secunia. It affects Microsoft Office 2000, Office XP and Office 2004 for Mac.

Users' machines can be compromised if they open a specially crafted Office file that contains the memory corruption error, according to the Secunia advisory. The exploit drops a trojan, dubbed Mdropper.Z by Symantec.

Alfred Huger, vice president of engineering in Symantec Security Response, told SCMagazineUS.com that this scenario is nothing new. Once attackers realize their discovery has been patched, they either start spreading the attack in a widespread manner or sell the exploit code to interested buyers.

Word is an attractive target, he said.

"It has a tremendously large user base," Huger said. "We normally see any user application that has a large footprint like is going to be targeted first (after Patch Tuesday)."

Symantec researchers have only received one in-the-wild attack submission from a customer, but they believe the exploit is being heavily distributed.

Users should be wary of opening files from untrusted sources, in addition to attachments from trusted sources that they were not expecting to receive.

A Microsoft spokesperson could not immediately be reached for comment.

See original article on SC Magazine US
Got a news tip for our journalists? Share it with us anonymously here.
Copyright © SC Magazine, US edition
Tags:

Most Read Articles

India's alarm over Chinese spying rocks CCTV makers

India's alarm over Chinese spying rocks CCTV makers

Hackers abuse modified Salesforce app to steal data, extort companies

Hackers abuse modified Salesforce app to steal data, extort companies

Cyber companies hope to untangle weird hacker codenames

Cyber companies hope to untangle weird hacker codenames

Woolworths' CSO is Optus-bound

Woolworths' CSO is Optus-bound

Log In

  |  Forgot your password?