Microsoft Word Zero-Day Used In Targeted Attacks 88
wiredmikey (1824622) writes "Microsoft warned on Monday of a remote code execution vulnerability (CVE-2014-1761) in Microsoft Word 2010 that is being actively exploited in targeted attacks. If successfully exploited, an attacker could gain the same user rights as the current user, Microsoft said, noting that users whose accounts are configured to have fewer user rights on the system could be less impacted than accounts with administrative privileges. 'The vulnerability could allow remote code execution if a user opens a specially crafted RTF file using an affected version of Microsoft Word, or previews or opens a specially crafted RTF email message in Microsoft Outlook while using Microsoft Word as the email viewer,' Microsoft explained Microsoft did not share any details on the attacks that leveraged the vulnerability, but did credit Drew Hintz, Shane Huntley, and Matty Pellegrino of the Google Security Team for reporting it to Microsoft."
Wasn't RTF supposed to be minimalistic and simple? (Score:5, Insightful)
Last time I looked RTF (decade or so ago) was a pretty bare-bones least-common-denominator document markup specification.
Is LibreOffice vulnerable to the same exploit? (Score:5, Insightful)
Re:this should never have happened (Score:2, Insightful)
Word processing was a solved problem in 1997, but Microsoft still has to continuously "upgrade" their software to be able to sell it again. They are out of good ideas, so they end up implementing bad ideas like adding system access to a simple protocol.
Re:Wasn't RTF supposed to be minimalistic and simp (Score:4, Insightful)