Stories
Slash Boxes
Comments

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Microsoft Issues Zero-Day Attack Alert For Word

Posted by kdawson on Tue Dec 05, 2006 10:51 PM
from the incoming dept.
0xbl00d writes "Eweek.com is reporting a new Microsoft Word zero-day attack underway. Microsoft issued a security advisory to acknowledge the unpatched flaw, which affects Microsoft Word 2000, Microsoft Word 2002, Microsoft Office Word 2003, Microsoft Word Viewer 2003, Microsoft Word 2004 for Mac and Microsoft Word 2004 v. X for Mac. The Microsoft Works 2004, 2005 and 2006 suites are also affected because they include Microsoft Word. Simply opening a word document will launch the exploit. There are no pre-patch workarounds or anti-virus signatures available. Microsoft suggests that users 'not open or save Word files,' even from trusted sources."
+ -
story

Related Stories

[+] No Fix for Word Next 'Patch Tuesday' 80 comments
Sktea writes "A spokesman for Microsoft has said that they will issue no patches on the next 'Patch Tuesday' for versions of Word vulnerable to the recent zero-day threat. There is no mention whatsoever of the omission in the latest advance notification at the company's security site." From the article: "The software maker is working on a security update, but apparently needs more time. The company did not specify how many flaws Tuesday's updates will address or in which components of Windows the holes lie. The Visual Studio update could offer a patch for a zero-day vulnerability in the developer tools that was made public last month. "
[+] Technology: Patch Tuesday — IE7 Clean 75 comments
jginspace writes "As per the advance notification, Microsoft's monthly security bulletin, released yesterday, addressed five general Windows issues and one in Visual Studio. It also included a fix for a problem in Outlook Express for a total of seven updates. As patch Tuesdays go it was fairly unremarkable. The only general Windows update labeled 'critical' is for a flaw in Media Player. As usual, there's a cumulative update for Internet Explorer, but significantly, the only versions of IE affected are 5 and 6. Version 7 is clean — which is welcome news in this first update since the upgrade was pushed to the world last month. Microsoft was silent on the two zero-day Word holes, one reported here and a new one. Sans is calling this 'Black Tuesday' and recommends patches be applied urgently for the Visual Studio and Media Player vulnerabilities. Sans is recommending the Heise Offline Update utility covered in a previous story."
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
 Full
 Abbreviated
 Hidden
More
Loading... please wait.
  • by sylvainsf (1020527) on Tuesday December 05 2006, @10:53PM (#17123564)
    That the business world just stop for a few minutes(days, weeks) while they fix this.
    • by Anonymous Coward on Tuesday December 05 2006, @10:58PM (#17123614)
      • by Anonymous Coward on Tuesday December 05 2006, @11:07PM (#17123728)

        Yes! Great idea! Just trust all of your internal documents to a random third party company with no privacy guarantees. But hey, at least they've made a vague "Do no evil" promise!!1!

      • by pdbaby (609052) on Wednesday December 06 2006, @12:01AM (#17124286)
        Isn't it more likely the sales patter for Office 2007 will become of course, if you were using our latest version...?
        Not that I'm suggesting Microsoft engineered it, mind... but it might not be as bad for them as seems initially
    • by Anonymous Coward on Tuesday December 05 2006, @11:03PM (#17123684)
      I wish Microsoft were a person. Then I could go up and kick that person in the nuts.
      • by Firehed (942385) on Wednesday December 06 2006, @12:21AM (#17124468) Homepage
        As will OpenOffice.org on all platforms. That's not the point - how on earth can someone code so sloppily that a WORD PROCESSOR has a serious security exploit?! And more importantly, what feature in aforementioned WORD PROCESSOR requires *anything* that could pose a security issue?

        Maybe the notion of writing all my papers in HTML wasn't so insane after all... no more of these archaic "pages", and it would certainly be a more reliable way of turning in assignments than e-mail attachments. Take care of a formatting stylesheet once, and from there on it's just using the <p> tag to full appropriateness.
        • by mikael (484) on Wednesday December 06 2006, @12:44AM (#17124664)
          how on earth can someone code so sloppily that a WORD PROCESSOR has a serious security exploit?!

          The usual reason - a local buffer created from the stack set to a fixed size. ie.

          char cbuf[MAX_BUFFER];

          I would guess that the Microsoft Word document file will be arranged using a chunk data format:
          file header followed by object headers with type, version, length, followed by binary data for that object
          In this way, unknown chunks can just be skipped over.

          It would be no surprise that each programmer coding a particular object (formula, table) would assume that only
          they would be theonly one writing read/write routines for their particular object, and choose to use a local stack
          buffer to store the raw binary data, before converting it to the internal data structure.

          When reading the document, they would just read the header as normal (type,version,length), then read the specified
          amount of object data without checking the validity of the length.

          And it only takes one programmer to make this mistake in order to create a security vulnerability that compromises
          the entire application. Get the right type of data in the Word document, and you could theoretically load and execute
          some executable code stored the file.
      • by ergo98 (9391) on Wednesday December 06 2006, @12:36AM (#17124588) Homepage Journal
        The Slashdot summary is deceptive (probably deliberately).

        It's probably closer to the mark than "receive unexpectedly". If someone in a corporation became infected, and they infect documents on a shared network location -- game over. Other users don't have to "receive" it via a classic-email virus, but rather they just have to go about their daily business. You touched on this yourself, and it is why this does basically mean "there be dragons" for all word files in corporations.
        It can't be triggered automatically, and limited accounts (like every Vista system) will be largely unaffected.

        Phew! Now that we know that the burgeoning community of Vista users will be "largely unaffected", we're safe! That comprises the set that downloaded and installed the RTM from MSDN, so at a minimum, around an installed base comparable to QNX.

        In any case, "largely unaffected" is more deceptive than the Slashdot summary (which came right from Cnet) -- the risk of compromises nowadays are seldom that they'll reconfigure your drivers or repartition your drive, thus requiring admin rights (when was the last time a virus was actually maliciously destructive in such a manner?), but rather that they'll compromise data integrity/security. If Bob is a normal user, but he's in HR and thus has rights to HR information, then so does an exploit running as Bob the unprivileged numbers-monkey.
      • by TheVoice900 (467327) <[ten.leisiklimak] [ta] [limak]> on Wednesday December 06 2006, @12:37AM (#17124614) Homepage
        It's not really deceptive, I often get attachments from almost everyone I regularly correspond with without expecting them first. Am I supposed to now call or email everyone I know every time they send me something to confirm that they intended to?

        As for being hardly affected, it simply says LESS affected. What's to prevent the trojan from taking over your Outlook client and using it to send spam and propagate itself to everyone you know as well. Doesn't take root to do that, nor countless other things.
  • by filesiteguy (695431) on Tuesday December 05 2006, @10:54PM (#17123574) Homepage
    If I can't even open my friends' documents then what am I - as a manager to do?

    Oh, wait - I don't do anything anyway and my life revolves around Excel.

    Nevermind.

  • Lets see... (Score:5, Funny)

    by jlarocco (851450) on Tuesday December 05 2006, @10:56PM (#17123604) Homepage

    So let me get this straight... For the time being the only safe Word files are new files that other people don't need to open?

    But hey, you saved a ton of money on retraining costs.

  • what about OO.org? (Score:5, Insightful)

    by no reason to be here (218628) on Tuesday December 05 2006, @10:58PM (#17123618) Homepage
    Could the problem be avoided by opening the any .doc files with OO.org? i'm assuming that the exploit will only work if the file is actually opened with word, so it would stand to reason that opening it with some other application would be safe. can anyone tell me why i'm wrong?
  • by Tsu Dho Nimh (663417) <.moc.liamtoh. .ta. .ixacaba.> on Tuesday December 05 2006, @11:00PM (#17123640)
    In the meantime, download and use OpenOffice [openoffice.org]
  • by Absolut187 (816431) on Tuesday December 05 2006, @11:05PM (#17123708) Homepage

    Microsoft suggests that users 'not open or save Word files,' even from trusted sources."
    [pause] You know what - Just to be safe, maybe you just shouldn't boot up any Windows PCs for a few days. And if you do: For god's sake, don't plug in a network cable.
  • Oh, great! (Score:5, Funny)

    by Marsala (4168) on Tuesday December 05 2006, @11:23PM (#17123910) Homepage

    Yet ANOTHER feature Word has that OpenOffice doesn't. :(

  • by surfcow (169572) on Tuesday December 05 2006, @11:42PM (#17124098) Homepage
    Dear Professor,

    My final project for the semester is attached as a Word document. If you have any problems reading it, please let me know. Me and everyone else in your address book.

    Don't have to worry about grading it. By the time you read this, I will have used the root-kit to grade it myself.

    Nice porn, by the way! You dog! We'll make this our little secret.

    love,
    toodles

  • by flyingfsck (986395) on Tuesday December 05 2006, @11:50PM (#17124170)
    How is one supposed to exercise caution when opening a Word document? Do click on it slowly and deliberately, or do you click it carefully after giving the PC a pat on the head...
  • by cheeseboy001 (986317) on Wednesday December 06 2006, @12:21AM (#17124474)
    Did anyone else read that as "Microsoft Ossues Zero-Day Attack Alert For World"?
    • by Kludge (13653) on Tuesday December 05 2006, @11:14PM (#17123796)
      That is nothing more than standard precautions that one should take anyway. If you aren't expecting an attachment, don't open it. If you are expecting it, and it is from a trusted source, go ahead.

      Really? I get documents that I'm not expecting all the time. I never have any fears opening Latex documents from anybody. You Microsoft folks sure have funny security.
    • Re:zero day (Score:5, Informative)

      by LarsG (31008) on Tuesday December 05 2006, @11:19PM (#17123836) Journal
      It means that there is a working exploit out there in the wild, which is using a vulnerability that was previously unknown to the security community / the software maker. That is, there was zero days warning.