Risk

3/26/2008
12:48 PM
Keith Ferrell
Keith Ferrell
Commentary
50%
50%

"New" Word Vulnerability: What Did Microsoft Know And When Did They Know It?

It turns out that Microsoft engineers knew about a vulnerability that could expose Word users to attacks, and knew about it for awhile before letting the rest of us in on the problem. A long while.

It turns out that Microsoft engineers knew about a vulnerability that could expose Word users to attacks, and knew about it for awhile before letting the rest of us in on the problem. A long while.The Jet Database Engine vulnerability exploitable via Word is one of those vulnerabilities that requires a targeted -- rather than broad -- attack.

Which doesn't mean it isn't a vulnerability, however "limited" (Microsoft's description) the risk it poses.

Nor was the risk so "limited" that Microsoft didn't feel obliged to let the world in on the problem after reports of some attacks began to circulate.

The vulnerability was announced by Microsoft last Friday -- two or three years after Microsoft became aware of it.

Take a look at this Microsoft security blog about the vulnerability -- and let me know if it annoys you that the company acknowledges awareness of this type of exploit and the vulnerability that invites it, yet did nothing about it. For three years.

My favorite part of the blog? The explanation that no alert -- much less fix -- for the problem was announced because Microsoft felt that an "attempt to attack customers using these issues was heavily mitigated" by file-blockers that prevented Outlook from opening the MDB files that could be exploited.

Mitigated!

So why let us know now?

To quote the blog again: "Everything changed with the discovery of this new attack vector..."

The new vector uses Word to open MDB files, unmitigating the mitigation, at least for users, as Microsoft puts it, of

Microsoft Word 2000 Service Pack 3, Microsoft Word 2002 Service Pack 3, Microsoft Word 2003 Service Pack 2, Microsoft Word 2003 Service Pack 3, Microsoft Word 2007, and Microsoft Word 2007 Service Pack 1 on Microsoft Windows 2000, Windows XP, or Windows Server 2003 Service Pack 1.

If you're running one of those you, to quote Microsoft again, "are vulnerable to these attacks."

Moving a step farther along the path from mitigated to unmitigated, there's this for all of you still running any of the vulnerable programs:

"Were investigating what it would take to release those fixes as part of the security update as a defense-in-depth change." I could tell Microsoft what it would take, and so could you, but that would require the use of unmitigated language that's not included in the bMighty stylesheet.

Fill in the blanks for me yourself -- and don't be mitigated about it.

Look: there are going to be big vulnerabilities and small vulnerabilities, holes that affect whatever the current largest market-share programs are, and holes hidden deep in older programs. We all know which ones get fanfare -- and which ones get fixed first.

But for the users running those older programs and thus exposed to the discovery of "new attack vectors" -- which are going to be discovered, no doubt of that -- the news that these holes have been waiting to be discovered for years, and that Microsoft knew it, is, well, it's just unmitigated ... [fill in this blank, too, according to your tastes and preferences in invective.]

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
Dark Reading Live EVENTS
INsecurity - For the Defenders of Enterprise Security
A Dark Reading Conference
While red team conferences focus primarily on new vulnerabilities and security researchers, INsecurity puts security execution, protection, and operations center stage. The primary speakers will be CISOs and leaders in security defense; the blue team will be the focus.
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: No, no, no! Have a Unix CRON do the pop-up reminders!
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.