We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
78,230 News Articles

Warning over new Word & Office hacks

Holes found two days after Microsoft's bug fix

Microsoft's Word and Office programs have been targeted again, with the company warning that hackers may already exploiting a new vulnerability found in the applications.

The warning comes just after the company issued fixes for 20 other bugs in its products on Tuesday, including six for Word.

The latest problem affects Office 2000 and Office XP, Microsoft said in a security advisory on Wednesday. An attacker could create a specially-crafted Word document that, if opened, could allow them to control a victim's computer remotely. As usual it advised great caution when opening unsolicited attachments.

Microsoft said it had received reports of "very limited, targeted" attacks. Danish security vendor Secunia AsP ranked the problem as "extremely critical”.

The emergence of a security bug so soon after Microsoft's scheduled patch release follows a familiar pattern by hackers, who want to maximise the amount of time they have to take advantage of a vulnerability, said Thomas Kristensen, Secunia's chief technical officer. Microsoft rarely diverts from its patch schedule, set for the second Tuesday of the month, although it said it would in this case if it considers it necessary.

Office applications such as Word are "low-hanging fruit" for hackers, since the programs haven't been audited as much as some others, such as Internet Explorer, Kristensen said.

The hackers find a vulnerability by manipulating a document and testing how Word reads it. In this case, a modified document can corrupt system memory in a way that allows the attacker to execute code on the machine remotely. As well as sending the document via email, the hacker could embed it in a web page and try to lure users into visiting that page.

"Attacking using this vector is fairly easy," Kristensen said.

However, new security features in Windows Vista, released to the general public last month, may prevent similar types of attack, so hackers may be making an extra effort to exploit them while they can, he said.


IDG UK Sites

OnePlus Two release date rumours: Something's happening on 22 July

IDG UK Sites

13in MacBook Air review, Apple's MacBook Air 2014 reviewed

IDG UK Sites

5 reasons to buy an electric car and 5 reasons not to

IDG UK Sites

Evernote Skitch: the best way for creatives to doodle feedback