Menu
Microsoft warns of Office zero-day, active hacker exploits

Microsoft warns of Office zero-day, active hacker exploits

Flaw unlikely to be patched in next week's security updates, says expert

Microsoft today said that attackers are exploiting a critical and unpatched vulnerability in Office 2007 using malformed documents to hijack Windows PCs and said Office 2003 and Office 2010 are also vulnerable.

The bug can be triggered by a malformed image file viewed on a website or in an email message if one of those versions of Office is installed on the system.

"We are aware of targeted attacks, largely in the Middle East and South Asia," Dustin Childs, a communications manager with the Microsoft Security Response Center (MSRC) said in a Tuesday blog entry.

It was initially unclear exactly which versions of Windows are at risk, and thus the extent of the problem for Microsoft's customers.

While Microsoft listed only Windows Vista and Windows Server 2008 as vulnerable in its initial advisory, the McAfee security researcher who reported the flaw to Microsoft last Thursday said that both Windows XP and Windows 7 could also be exploited through malicious Office files.

"While we spotted the attack performed via Office 2007 running on Windows XP, this is actually a fault existing in a TIFF-processing component shipped with Microsoft Office," wrote Haifei Li on McAfee's website. "Therefore, not only is Office 2007 with Windows XP vulnerable to this attack, but also more environments are affected, [including] Office 2007 running on Windows 7."

Microsoft tried to clarify the situation on its Security Research & Defense blog, but did not list every affected Windows-Office combination. According to details spelled out by MSRC engineer Elia Florio, anyone running Office 2003 or 2007, no matter what operating system powers the PC, is affected, while only those running Office 2010 on Windows XP or Server 2003 are at risk.

Office 2013, Microsoft's newest, does not contain the vulnerability, said Florio.

In an email received from a company spokesperson, Microsoft set the record straight, saying that the vulnerable scenarios are: Office 2003 and Office 2007 on all platforms; Office 2010 on XP and Server 2003 only; and all supported versions of Lync.

Childs said that Microsoft is working on a patch, but did not mention a timetable for delivering a fix.

Andrew Storms, director of DevOps at San Francisco-based CloudPassage, thought it very unlikely that Microsoft would move fast enough to put something in customers' hands next week; Microsoft's Patch Tuesday this month is slated for Nov. 12.

"I would not expect it on Patch Tuesday," Storms said in an interview today. "If it was IE [Internet Explorer], maybe. And I don't think they're taking any chances, what with the problems with some updates lately. They'll move very cautiously on this, unless their telemetry shows that attacks have really spread."

Storms was referring to several updates since April, including ones for Windows 7, the Exchange email server software and Office, that Microsoft has had to withdraw and rework after post-patching problems plagued users. Some security experts, including Storms, have wondered whether Microsoft has lost grip on its once-notable quality control.

Today, Microsoft urged customers to apply a temporary work-around until a patch is available, and posted links to an automated "Fixit" stop-gap on a support document.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags mcafeeMicrosoftWindowssoftwareMalware and Vulnerabilitiesoperating systems

Slideshows

Top 50 defining moments of the New Zealand channel in 2016

Top 50 defining moments of the New Zealand channel in 2016

Reseller News looks back on a tumultuous 12 months for the New Zealand channel, assessing the fallout from a year of sizeable industry change. Whether it be local or global mergers and acquisitions, distribution deals or job changes, the channel that started the year differs somewhat to the one set to finish it - Reseller News assesses the key moments that made 2016.​

Top 50 defining moments of the New Zealand channel in 2016
​Hewlett Packard Enterprise honours high achieving NZ channel

​Hewlett Packard Enterprise honours high achieving NZ channel

Hewlett Packard Enterprise honoured its top performing Kiwi partners at the second running of its HPE Partner Awards in New Zealand, held at a glitzy ceremony in Auckland. Recognising excellence across eight categories - from distributors to resellers - the tech giant celebrated its first year as a standalone company, following its official split from HP in 2015.

​Hewlett Packard Enterprise honours high achieving NZ channel
Nutanix treats channel partners to Christmas cruise

Nutanix treats channel partners to Christmas cruise

Nutanix recently took to the seas for a Christmas Cruise around Sydney Harbour with its Australia and New Zealand staff, customers and partners to celebrate a stellar year for the vendor. With the sun out, they were all smiles and mingled over drinks and food.

Nutanix treats channel partners to Christmas cruise
Show Comments