Symantec raises alarm on Microsoft Word hack attack

Stan Beer
Sunday, 21 May 2006 15:52

Business IT - Security

Worries about Microsoft Word attachments in emails have surfaced with the news that hackers have begun to exploit a zero-day vulnerability in Word 2003 using a new Trojan horse virus. The seriousness is compounded by the fact that a fix from Microsoft could be more than three weeks away.

Anti-virus vendor Symantec raised an alert on Friday about the Word 2003 vulnerability and the fact that hackers were on the march trying to get control of PCs running the current version of the Microsoft word processor. According to Symantec, opening email attachment that looks like a word document actually opens an executable Trojan horse program, called Trojan.Mdropper.H, which in turn gives a hacker access to the user's system.

According to Microsoft, a fix for the vulnerability is on its way. However, the earliest date that Microsoft has committed to so far is June 13, leaving hackers a significant Window of opportunity to try and hit their vulnerable targets.

Symantec, which has broadcasted an alert about the vulnerability on its home page, has warned users to be extra careful when opening any Microsoft Word documents, whether they receive them as an email attachment or through another means such as a website or instant message. According to Symantec, attacks so far appear to be targeting enterprise users, although that could change.

The latest Microsoft vulnerability alert has been raised by the same anti-virus vendor that recently launched one of the most far reaching lawsuits against Microsoft in its history. Symantec, the leading desktop security vendor, last week filed a suit, seeking to prevent the release of Microsoft's new desktop operating system, Windows Vista. In its lawsuit, Symantec alleges that Microsoft has built Vista and other products on misappropriated intellectual property invented by Symantec's recently acquired storage management company Veritas.

Symantec, like other security vendors, continually issues alerts about Microsoft vulnerabilities such as the current one. Microsoft has touted its upcoming Windows Vista operating system as fixing the security issues of previous releases, thus making it less vulnerable to attacks. {moscomments}