Microsoft confirms Word attacks

Microsoft confirms Word attacks

Summary: Microsoft has confirmed reports of vulnerability in Word that allows an attacker to exploit a system via the Microsoft Jet Database Engine, which shares data with Access, Visual Basic and third party applications.Microsoft in its advisory said the potential for attack is "very limited.

SHARE:

Microsoft has confirmed reports of vulnerability in Word that allows an attacker to exploit a system via the Microsoft Jet Database Engine, which shares data with Access, Visual Basic and third party applications.

Microsoft in its advisory said the potential for attack is "very limited." Reports of the Word flaw were highlighted by Panda and Symantec in the last two weeks. On March 3, Panda researcher Ismael Briones stumbled on the new exploit. On Thursday, Symantec also noted the Jet vulnerability. According to Symantec.

The attacker needs only to find a trick to force the MS Jet library to open the file and trigger the vulnerability that will run the malicious shellcode. Some social engineering and a little help from Office applications will work out well in this specific attack. In fact, it is possible to call MSJET40.DLL directly from MS Word, without using Access at all.

Microsoft said in its advisory:

Customers running Windows Server 2003 Service Pack 2, Windows Vista, and Windows Vista Service Pack 1 are not vulnerable to the buffer overrun being attacked, as they include a version of the Microsoft Jet Database Engine that is not vulnerable to this issue.

Customers using Microsoft Word 2000 Service Pack 3, Microsoft Word 2002 Service Pack 3, Microsoft Word 2003 Service Pack 2, Microsoft Word 2003 Service Pack 3, Microsoft Word 2007, and Microsoft Word 2007 Service Pack 1 on Microsoft Windows 2000, Windows XP, or Windows Server 2003 Service Pack 1 are vulnerable to these attacks.

Microsoft is investigating the public reports and customer impact. We are also investigating whether the vulnerability can be exploited through additional applications. Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This may include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs.

Microsoft then reiterated that the risk is limited since a customer would have to take multiple steps to make an attack successful.

Topics: Windows, Collaboration, Microsoft, Operating Systems, Security, Software

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

36 comments
Log in or register to join the discussion
  • No, in Jet

    >>Microsoft has confirmed reports of vulnerability in Word

    Grammatical issue aside, the vulnerability is in the Jet engine, not Word. Word is the vector.
    larry@...
    • I note how MS use it as an opportunity to push Vista

      You'll be safe if you use Vista or 2007, so don't dare not upgrade .....
      mark@...
  • Vista is NOT vulnerable: yet another reason to use Vista

    yet another reason to use Vista
    qmlscycrajg
    • Use Vista so you can use Word.......

      I just don't know if that is a selling point or not.

      Pagan jim
      James Quinn
      • Not

        I will never willingly use Word or any part of Office.

        Too much work to accomplish things i can do a lot more easily in other programs.
        fairportfan
    • I'd rather take my chances with the exploit....

      Since it is basically a targeted exploit and Vista is not an operating system, it's a 4GB screen saver.
      dunn@...
      • "Vista is a 4GB screen saver"

        That is the best explanation of Vista that I have read so far.
        wackoae
      • RE: I'd rather take my chances wit hthe exploit...

        Quote: [i]Since it is basically a targeted exploit and [b]Vista is not an operating system, it's a 4GB screen saver. [/b][/i]

        Shoot, I thought it was a [b]resource hog!!!![/b] (Hmmmm That would make an interesting grafix!!!!)
        fatman65535
        • Vista's a 4GB Screen Saver - AND a Resourse Hog!

          Yes, it's two! TWO! Two headaches in one!

          Still backgraded to XP....
          drprodny
          • Pathetic !

            We are "DISCUSSING WORD" for goodness sake!
            Read the subject then articulate...about the subject...constructively so we can all enjoy your colourful wit.
            Richard Turpin
        • Vista is...

          ...both a floor wax AND a dessert topping!
          fairportfan
          • Tasty!

            And don't worry if you spill it, it cleans and shines as you wipe it up.
            seanferd
    • Unless of course...

      Your machine is *ahem* Vista Capable (or not), and then there's the potential SP1 issues. What do you expect all those people to do? Shell out more money to solve a problem that Microsoft should have solved. And please note that "only a minority are affected" in the windows space usually means in the millions of systems.

      Also, if I recall correctly (and I might be wrong), but I think it was around 2-3 years ago that Microsoft knew of this flaw, and I think they said they were not going to fix it. Well, golly gee that there's an exploit of few out there now.
      zkiwi
    • "Another" reason?

      ....must have missed the previous ones (assuming this IS reason enough).
      alf@...
    • Yeah.... sure......right...

      Vista is not vulnerable to this particular flaw in Word. So I guess that makes Vista great.... right? Yeah.... until the next Vista flaw is found.

      I don't think I want to use Vista just so I can use Word.
      shawkins
  • RE: Microsoft confirms Word attacks

    There is NO reason to use Vista.
    afficionado
  • Liars!!

    If the attack surface is "very limited"...would someone just "stumble upon" it? Doubtful. As stated, it requires multiple steps. Either Mr. Briones was indeed targeting such an exploit...or Microsoft is trying to minimize the reality of the attack surface.
    Techboy_z
    • The Steve Ballmer Reality Distortion Field?

      Steve Job's RDF makes everything pretty look like it's better, even when it's really not. Steve Ballmer's RDF makes serious flaws in the product seem much smaller than they really are.

      Besides, how many people using Windows XP and/or Windows 2000 have installed Microsoft Office (or at least Microsoft Works featuring Microsoft Word)? I'm guessing thousands upon thousands...
      nix_hed
      • More like Millions Upon Millions

        Since only a handful of Windoze Bigots would VOLUNTARILY use Vista.... :pppp
        drprodny
  • Additional information

    Anyone running Linux is NOT
    vulnerable to this attack.

    Just a little extra benefit.
    Ole Man