Microsoft has confirmed that what appeared to be a newly discovered Word flaw is actually a variant of a vulnerability revealed last year, according to Symantec.
However, numerous organizations have been targeted by exploits taking advantage of the word processor vulnerability, Eric Chien, Symantec researcher, said Thursday in a posting on the Symantec Security Response blog.
Chien said the flaw is being actively exploited in the wild, and advised customers to be careful opening Word email attachments.
The bug is a variation of a Microsoft Word flaw (CVE – 2006 -6456), revealed last year.
Chien first reported the flaw – and attacks exploiting it using the Mdropper.x trojan – on Tuesday.
A fourth Word flaw came to light last week, and is being used in limited attacks, according to Microsoft.
All of the vulnerabilities could be exploited to execute arbitrary code, allowing attackers to drop a trojan on an infected machine. Some experts predicted that Microsoft would release an out-of-cycle patch for the flaws, but so far Redmond has remained mum on its patching plans.
Click here to email Online Editor Frank Washkuch.
