Vendors Warn of Microsoft Word Zero-Day Flaw

<a href="http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1320512,00.html">SearchSecurity.com</a>, <a href="http://www.theregister.co.uk/2008/07/09/zero_day_word_flaw">The Register</a>

Jim Manico, OWASP Global Board Member

July 9, 2008

1 Min Read

Microsoft is echoing warnings from Symantec about an unpatched vulnerability in Word that has become the subject of targeted attacks.Specifically, the flaw affects Office Word 2002, Service Pack 3, enabling a hacker to gain full rights to a user's computer. "At this time, Microsoft is aware of limited, targeted attacks that attempt to use this vulnerability," the company stated in a security advisory that suggests two workarounds while it investigates the problem. "While Microsoft Office Word 2000 does not appear vulnerable to this issue, Word 2000 may unexpectedly exit when opening a specially crafted .doc file that the attacker is using in an attempt to exploit the vulnerability."

Microsoft said the vulnerability -- which follows a low-key Patch Tuesday, as well as a separate security flaw involving its Access database program -- can't be exploited automatically via e-mail.SearchSecurity.com, The Register

Read more about:

2008

About the Author(s)

Jim Manico

OWASP Global Board Member

Jim Manico is a Global Board Member for the OWASP foundation where he helps drive the strategic vision for the organization. OWASP's mission is to make software security visible, so that individuals and organizations worldwide can make informed decisions about true software security risks. OWASP's AppSecUSA<https://2015.appsecusa.org/c/> conferences represent the nonprofit's largest outreach efforts to advance its mission of spreading security knowledge, for more information and to register, see here<https://2015.appsecusa.org/c/?page_id=534>. Jim is also the founder of Manicode Security where he trains software developers on secure coding and security engineering. He has a 18 year history building software as a developer and architect. Jim is a frequent speaker on secure software practices and is a member of the JavaOne rockstar speaker community. He is the author of Iron-Clad Java: Building Secure Web Applications<http://www.amazon.com/Iron-Clad-Java-Building-Secure-Applications/dp/0071835881> from McGraw-Hill and founder of Brakeman Pro. Investor/Advisor for Signal Sciences.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights