Print

---

Well, Word has a long history of exploits, going back years to macro
viruses.  This is the second exploit of this form this year.

As far as I can tell, Symantec and McAfee haven't got signatures out
yet.  One place quoted Symantec suggesting that organizations block
Word attachments at the network perimeter.

Yes, any file format is susceptible.  I never expected to see a JPEG
exploit but it's happened (under Windows a couple years ago).

There are other reasons not to send announcements out in Word format,
including some very celebrated cases where reporters traced the
editing done to the document by exploiting version tracking.

By the way, McAfee lists Mac versions of Word as also vulnerable:

    Microsoft Word  2000,
    Microsoft Word  2002,
    Microsoft Word  2003,
    Microsoft Word Viewer  2003,
    Microsoft Word  2004 for Mac,
    Microsoft Word  2004 v. X for Mac,
    Microsoft Works Suite  2004,
    Microsoft Works Suite  2005,
    Microsoft Works Suite  2006,
    Windows XP  SP0 - SP2,
    Windows 2003  SP0 - SP1,
    Windows 2000  SP4,

/rich

On 12/8/06, Chris Wolf <[log in to unmask]> wrote:
> Two counterpoints however:
>
> 1) It's very likely that exploits of the Word vulnerability could easily be
> recognized by signature-based virus detection, so the exposure interval
> should be small for many people.
>
> 2) Do we really know that PDF files could not be equally dangerous? The
> recent Adobe vulnerability was in their IE ActiveX control, not in Acrobat
> or Reader itself, but I wonder if any file format is really safe these days.
> The advice now, as always, should be don't open ANY attachment that is
> unexplained, unexpected, or otherwise suspicious.
>
> > -----Original Message-----
> > From: MSU Network Administrators Group
> > [mailto:[log in to unmask]] On Behalf Of Richard Wiggins
> > Sent: Friday, December 08, 2006 9:56 AM
> > To: [log in to unmask]
> > Subject: Re: [MSUNAG] Apparently a zero-day attack using Word
> > is happening
> >
> > From what I've read this is not very widespread, but it is
> > occurring against specific targets -- organizations and
> > individuals.  You receive an e-mail spoofing someone within
> > your organization.  It has a Word attachment.  You open it,
> > and your computer is infected.
> >
> > The advice from Microsoft is not to open Word documents from
> > anyone, even trusted senders.  Only open Word documents you
> > are expecting from trusted senders.  This is another reason
> > why people should use PDF for formatted announcements, and
> > only send Word documents if they intend for the recipient to
> > edit them.
> >
> > The press is speculating that Microsoft may not have a patch
> > ready for the next Patch Tuesday.
> >
> > /rich
> >
> > On 12/8/06, Cheryl Akers <[log in to unmask]> wrote:
> > > Published: December 5, 2006
> > > http://www.microsoft.com/technet/security/advisory/929433.mspx
> > >
> > > Microsoft is investigating a new report of limited zero-dayattacks
> > > using a vulnerability in Microsoft Word 2000, Microsoft Word 2002,
> > > Microsoft Office Word 2003, Microsoft Word Viewer 2003,
> > Microsoft Word
> > > 2004 for Mac, and Microsoft Word v. X for Mac, as well as Microsoft
> > > Works 2004, 2005, and 2006.
> > >
> > > Also see
> > >
> > http://www.symantec.com/enterprise/security_response/weblog/2006/12/mi
> > > crosoft_word_0day_under_inve.html
> > > Cheryl
> > >
> > > Cheryl Akers, MS, CNA - [log in to unmask] Microcomputer Support -
> > > Microbiology and Molecular Genetics 2228C Biomedical
> > Physical Sciences
> > > Michigan State University East Lansing, MI  48824
> > >
> > > 517-355-6463 X1514
> > >
> > > "I try to take one day at a time, but sometimes, several
> > days attack
> > > me at once."
> > > Jennifer Unlimited
> > >
> >
>