RSSSymantec Discovers New Word Attack
By Ed Oswald | Published January 26, 2007, 1:14 PM
Microsoft is investigating reports of a new zero-day attack on Microsoft Word, and is aware of "very limited attacks" exploiting the vulnerability. Worse yet, it is not related to three other flaws in Word unpatched by Microsoft, says Symantec.
The issue is known to affect Office XP, 2000 and Office 2003 on Windows 95, NT, 98, Me, 2000, Server 2003 and XP. It is known that the exploit involves the execution of arbitrary code, but specifics of the actual issue are not yet known.
When an attack is launched against either Word 2003 or XP, CPU resources are completely consumed and a denial-of-service results. The issue was discovered after one of Symantec's researchers spotted the exploit during a live attack.
In that attack, a specially crafted Word document arrives via e-mail, attempting to trick the user into opening it. When launched, the exploit installs a Trojan that opens a backdoor on the infected computer.
From there, the Trojan connects to a remote server and sends sensitive documents and logged keystrokes, Symantec warned.
"To protect yourself against these threats, do not trust unsolicited files or documents about 'interesting' topics," the company said in a security alert. "Do not open attachments unless they are expected and come from a known and trusted source."
Currently, no patch or workaround for the issue exists, Symantec said. If Microsoft confirms the vulnerability, it would likely issue an advisory and suggest workarounds to avoid the issue.
And all this time, I thought the worst attack on word was the public school system. Heh heh. Get it, er um, nevermind. :(
Score: 0
|In Symantec's defense, while their software is mostly crappy, consider the number of viruses and flaws that they are the first to discover.
While I may never use their antivirus or security software again, I certainly do appreciate the fact that they are certainly doing some positive things--my job is PC tech support, and since about one fifth of the calls (in PC hardware support department) are directly related to viruses missed by Symantec or problems with their software, they are critical towards creating jobs for tech support (lol). Also, as the former king of the Antivirus software, it is also a wonderful excuse for any software problems:
Customer: My computer is really slow.
Tech: Are you running an antivirus?
Customer: Yes, Symantec Utilities.
Tech: Ahh, no wonder it's slow.
(kidding)
Yup, world without Symantec may sound great at first, but in the end think of how many PC support technicians that will lose their jobs :D
Score: 0
|I'm so tired of Microsoft being a synonym for all the dirty words — attack, trojan, phishing, exploit, bomb, virus, etc.
I'm packing up and moving to OpenOffice with its sleek, cool OASIS OpenDocument Format (ODF).
Score: 0
|this news is wrong, because
only Word 2000 is affected by this new flaw.
Score: 0
|An excellent opportunity to uninstall Microsoft Office and install Open Office. :)
www.openoffice.org
Score: 0
|why? I use Office 2003 which is not affected by this new flaw. And for old Word 2000, Norton Antivirus catches these trojans
Score: 0
|Highly critical flaw in OpenOffice 2.x (2007-01-04)
http://secunia.com/advisories/23612/
Critical: Highly critical
Impact: System access
Where: From remote
Software: OpenOffice.org 2.x
OpenOffice 1.1.x
OpenOffice 1.0.x
John Heasman has reported some vulnerabilities in OpenOffice, which can be exploited by malicious people to compromise a user's system.
Successful exploitation of the vulnerabilities allows execution of arbitrary code and requires that a user is tricked into opening a specially crafted WMF/EMF file or a specially crafted document.
The vulnerabilities are reported in OpenOffice prior to version 2.1.0. Other versions may also be affected.
Multiple integer overflows in OpenOffice.org (OOo) 2.0.4 and earlier, and possibly other versions before 2.1.0; and StarOffice 6 through 8; allow user-assisted remote attackers to execute arbitrary code via a crafted (a) WMF or (b) EMF file that triggers heap-based buffer overflows in (1) wmf/winwmf.cxx, during processing of META_ESCAPE records; and wmf/enhwmf.cxx, during processing of (2) EMR_POLYPOLYGON and (3) EMR_POLYPOLYGON16 records.
Score: 0
|Why does it affect only to Word 2000? In my humble opinion it may be explained this way: Since 2001, all MS systems, apart from using internet in the active sense, that is for you to search, works also in the opposite mode, i.e. they allow reaching your hard drive files from any other computer, even if you are far away from home. As far as I know, before that date that possibility was never implemented for personal computers. It may be very convenient for your own use, in special if you've got also a laptop, but your hard drive can also be reached by anyone who knows how to do it. MS makes use of this availability in their own interest to fight piracy, and hackers make use of it to cheat MS and many other illegal purposes. You find yourself just in the middle of the mess, supporting continuous attacks and buying more and more upgrades, antiviruses and firewalls. At last, all this means big business. But that is too much when you run the "oldie" Word 2000, because it was not made to survive in such a difficult situation.
Score: 0
|BTW I use Microsoft Office 97 since 1997 running Windows 98 SE since 1999. It's OK. I have bad experiences of upgrades, and keep using the "oldie", even when I live in a developed country, not for any resistence to changes but because I feel more security and freedom in "oldies" than in any upgrade I tried. Of course I only use my computer when I can't use any other more solid device for the same purposes, i.e. to play games; to watch terrestrial and satellite or cable TV, for recording movies on HD/DVD, for surround effects etc. I never use the computer but the best devices I may pay. In the middle/long run it becomes cheaper and your computer is always OK.
Score: 0
|I half hope our company gets hit by a malicious word virus, so that we can consider open office as a realistic alternative?
GG Microsoft on pushing for silly Vista when your current products fail. Real cool.
Score: 0
|You are an idiot. Open Office can have viruses too my friend.
First hoping your company gets hit by a worm and secondly thinking open office is what they should use to solve the problem.
Score: 0
|"To protect yourself against these threats, do not trust unsolicited files or documents about 'interesting' topics," the company said in a security alert. "Do not open attachments unless they are expected and come from a known and trusted source."
You'd think after giving that same advice after every email virus in the past eight years or so that people would actually heed that advice. Then again, maybe our anti-symantec rants are causing people to ignore symantec's suggestions here, which are good suggestions regardless of how crappy their software is.
Score: 0
|Amen.
Score: 0
|