[ISN] New MS-Word macro warning

From: InfoSec News (isnat_private)
Date: Wed May 23 2001 - 00:10:29 PDT

  • Next message: InfoSec News: "[ISN] U.S. net-security proposal draws cool industry response"

    By: Thomas C Greene in Washington
    Posted: 22/05/2001 at 05:30 GMT
    While it's true that all recent versions of MS Office supposedly
    require the user's permission to run a macro, a wee little oversight
    at Redmond Security Central makes it possible for an RTF (Rich Text
    Format) document opened by Word to execute a macro automatically if
    it's embedded in a template.
    "When Word is used to open a document thats based on a template, both
    the document and the template should be checked for macros. This
    vulnerability involves a case in which this isnt done correctly," an
    MS security bulletin explains, doing its damnedest not to say 'we
    Macros run on a machine or network at the user's level of permission,
    so of course a malicious one can perform quite a lot of mischief.
    In this case, developing an exploit would be child's play. The
    required template could be fetched from a remote location, such as a
    Web site to which the feature-rich Word can connect automatically.
    This would be the preferred MO for someone trying to propagate via
    e-mail a macro virus exploiting the RTF vulnerability.
    RTF is something of the lingua franca of word processing, readable by
    just about every application ever designed, so it's still in common
    use wherever people have to collaborate whilst using different
    Affected programs include Word 97; Word 98 (J); Word 2000; Word 98
    (Mac); and Word 2001 (Mac), but not Word 2002.
    "Previous versions [of Word] are no longer supported and may or may
    not be affected by this vulnerability," MS says. It's reasonable to
    assume that they are affected, so there we have one more little motive
    to upgrade.
    ISN is hosted by SecurityFocus.com
    To unsubscribe email isn-unsubscribeat_private

    This archive was generated by hypermail 2b30 : Wed May 23 2001 - 00:22:15 PDT