Patch/Configuration Management, Vulnerability Management

Microsoft refutes exploit-site reports of Office flaws

The same week Microsoft released April's second Patch Tuesday distribution, a hacker claimed on exploit websites to have found a number of application flaws. Microsoft today said it has found no such vulnerabilities.

The hacker, using the moniker Muts, said he found a number of file format bugs in just three hours. He acknowledged the bugs on the Milw0rm and Security Vulnerabilities websites.

However, a Microsoft spokesman said the Redmond, Wash.-based company is investigating the reports. initial inquiries have found no flaws in Word 2007 or Office 2007. The investigation is ongoing, according to the spokesperson.

Microsoft is not aware of any attacks targeting the reported flaws, the spokesperson said.

On Tuesday, Microsoft released five fixes for eight server- and client-side vulnerabilities that could lead to attackers executing arbitrary code.

The most pressing fix released was MS07-021, which fixes a privilege escalation flaw in Microsoft Client/Server Runtime Server Subsystem (CRSSS) and affects all operating system versions, including Vista.

Last Tuesday, Microsoft released an emergency, out-of-cycle patch for a vulnerability in the way Windows handles ANI files, a flaw being exploited by thousands of malicious sites.

Amol Sarwate, director of Qualys’ vulnerability research lab, told today that exposure of flaws around Patch Tuesday has become the norm in recent months.

"No, this is not really unusual. What we have seen the past few Patch Tuesdays is that there are vulnerability announcements right before and right after, so it gives vendors very little time to react," he said.

Click here to email Online Editor Frank Washkuch.

Looking for a new job? has the latest IT security employment opportunities. Click here for our jobs page.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.