Microsoft warns of zero day attack on Word 2002

Stephen Withers
Thursday, 10 July 2008 04:08

Your IT - Home IT

Microsoft has warned of a newly discovered vulnerability in Microsoft Office Word 2002 Service Pack 3 that is being used in targeted attacks which could corrupt memory and take control of the victim's computer. The zero day attack follows a familiar pattern of exploits coinciding with Patch Tuesday to maximise the window between discovery and the availability of a fix.

The exploit involves a maliciously crafted .doc file that corrupts the contents of memory, providing an opportunity to execute arbitrary code.

A successful exploit of this flaw is said to give the attacker the same rights as the current user. That's small comfort, as people still running Word 2002 are likely to be set up as administrative rights - much vintage software will only work correctly if the user is an admin.

There is better news: Microsoft says the vulnerability is specific to Word 2002 SP3, and has specifically stated that it cannot be exploited on Word 2000 SP3, 2003 SP2 and SP3, 2004, 2007 and SP1, and 2008.

Since Word Viewer 2003 (including SP3) is also safe from the flaw, that program provides Word 2002 users with a safe way of reading files received from doubtful sources. Microsoft is suggesting the use of Word Viewer 2003 as a workaround until a patch for Word 2002 is available.

A side effect of the exploit is that opening the document in Word 2000 will crash the application.

Microsoft's advice is "Do not open or save Microsoft Office files that you receive from untrusted sources or that are received unexpectedly from trusted sources."

So what's the nature of the attack? Pleae read on.