M$ Announces zero-day word vulnerability

[rustypup]

source

Microsoft on Dec. 5 warned that an unpatched vulnerability in its Word software program is being used in targeted, zero-day attacks.

Affected software versions include Microsoft Word 2000, Microsoft Word 2002, Microsoft Office Word 2003, Microsoft Word Viewer 2003, Microsoft Word 2004 for Mac and Microsoft Word 2004 v. X for Mac. The Microsoft Works 2004, 2005 and 2006 suites are also affected because they include Microsoft Word.

There are no pre-patch workarounds available. Microsoft suggests that users "not open or save Word files," even from trusted sources. "As a best practice, users should always exercise extreme caution when opening unsolicited attachments from both known and unknown sources," the company said.

<beavis>
ha! ha!
</beavis>

so, the suggestion is... don't use office 'till they get around to finally fixing this... how is this a viable option?

<continues to delete everything with unsolicited attachments>
<apologies to jamin_za... as tempting as "tubgirl in kazakhestan" sounded, it got scrubbed >

[Samaya]

Damn, I had better stop using word as my mail editor in Outlook...

[rustypup]

so, patch tuesday came and went without even a blip from microsft about this particular little "flaw-by-design"... and now..
source

Exploit code for a third, unpatched vulnerability in Microsoft Word has been posted on the Internet, adding to the software maker's struggles to keep up with gaping holes in its popular word processing program.

The attack code, available at Milw0rm.com, contains sample Word documents that have been rigged to launch code execution exploits when the file is opened.

"Data used by Microsoft Word to construct a destination address for a memory copy routine is embedded within a Word document itself. If an attacker constructs a Word document with a specially crafted value used to build this destination address, then that attacker may be able to overwrite arbitrary memory," the US-CERT warned.

lo-tek rules...
<reaches for the typewriter... finds the half the keys melded to the frame..>

[Samaya]

I checked that site just now. There is some seriously scary stuff in there. Especially the MD5 hashing cracking part. We use MD5 on some of our secure logs... 8O :shocked:

[M1ke]

However, apparently it's extremely rare?
but still scary

[PaperCut]

Luckily, I use MS Office 2007

[M1ke]

How is it? A friend of mine wants to know how vast an improvement it is over 2003.