Worm Attack: New Microsoft Word Zero-Day Flaw Exploited by Email Attackers

[mandy]

A zero-day flaw in the ubiquitous Microsoft Word software program is being used in an active exploit by sophisticated hackers in China and Taiwan, according to warnings from anti-virus researchers...

The exploit arrives as an ordinary Microsoft Word document attachment to an e-mail. However, when the document is launched by the user the vulnerability is triggered to drop a backdoor with rootkit features to mask itself from anti-virus scanners...

When the .doc attachment is opened, it exploits a previously unknown vulnerability in Microsoft Word and infects a fully patched Windows system. The exploit functioned as a dropper, extracting and launching a Trojan that immediately overwrites the original Word document with a "clean," uninfected copy...

full article: http://www.eweek.com/article2/0,1895,1965042,00.asp

[mandy]

Microsoft has issued a security advisory that offers some tips on how to protect yourself against attack until the company issues a patch in June.

Workarounds for Microsoft Word Code Remote Code Execution Using a Malformed Object Vulnerability:

Microsoft has tested the following workarounds. While these workarounds will not correct the underlying vulnerability, they help block known attack vectors.

Step 1 Always use Microsoft Word in Safe Mode

Step 2 Append /safe to the WINWORD.EXE command line

Suggested Actions

Guidelines for Office Documents in SAFE MODE

Do not open Word files that are embedded in other applications, such as Excel, PowerPoint and others.

Home users - Even after applying the workarounds do not open Word files directly from ANY mail clients for example, Outlook or Hotmail by double-clicking them. Save your word document to a disk or onto your desktop and use the “Word Safe Mode” Shortcut.

Enterprise users - Even after applying the workarounds do not open Word files directly from mail clients other than Outlook, for example hotmail by double-clicking them.

Do not open .doc from a web site via Internet Explorer or any other browser.

If you do not see “Safe Mode” in Word title bar you are not running Word in safe mode. Do not attempt to open any word files as you may be vulnerable to the malicious .doc files.

You can use Word Viewer 2003 to open any files without being affected by this vulnerability.

Protect Your PC

We continue to encourage customers follow our Protect Your PC guidance of enabling a firewall, getting software updates and installing ant-virus software. Customers can learn more about these steps by visiting Protect Your PC Web site.

All customers should apply the most recent security updates released by Microsoft to help ensure that their systems are protected from attempted exploitation. Customers who have enabled Automatic Updates will automatically receive all Windows updates. For more information about security updates, visit the Microsoft Security Web site.

We recommend that customers exercise extreme caution when they accept file transfers from both known and unknown sources. For more information about how to help protect your computer while you use MSN Messenger, visit the MSN Messenger Frequently Asked Questions Web site.

Keep Windows Updated

All Windows users should apply the latest Microsoft security updates to help make sure that their computers are as protected as possible. If you are not sure whether your software is up to date, visit the Windows Update Web site, scan your computer for available updates, and install any high-priority updates that are offered to you. If you have Automatic Updates enabled, the updates are delivered to you when they are released, but you have to make sure you install them.

full security advisory: http://www.microsoft.com/technet/securit...19637.mspx