Application security, Patch/Configuration Management, Vulnerability Management

Microsoft tells Symantec that latest exploited Word flaw is variation of older vulnerability

Microsoft has confirmed that what appeared to be a newly discovered Word flaw is actually a variant of a vulnerability revealed last year, according to Symantec.

However, numerous organizations have been targeted by exploits taking advantage of the word processor vulnerability, Eric Chien, Symantec researcher, said Thursday in a posting on the Symantec Security Response blog.

Chien said the flaw is being actively exploited in the wild, and advised customers to be careful opening Word email attachments.

The bug is a variation of a Microsoft Word flaw (CVE – 2006 -6456), revealed last year.

Chien first reported the flaw – and attacks exploiting it using the Mdropper.x trojan – on Tuesday.

A fourth Word flaw came to light last week, and is being used in limited attacks, according to Microsoft.

All of the vulnerabilities could be exploited to execute arbitrary code, allowing attackers to drop a trojan on an infected machine. Some experts predicted that Microsoft would release an out-of-cycle patch for the flaws, but so far Redmond has remained mum on its patching plans.

Click here to email Online Editor Frank Washkuch.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.