[ISN] No Fixes for Microsoft Word Zero-Day Flaws

From: InfoSec News (alerts@private)
Date: Tue Jan 09 2007 - 22:11:44 PST


By Ryan Naraine
January 9, 2007

Microsoft has released high-priority fixes for serious vulnerabilities 
in its Outlook and Excel applications, but there are no patches in the 
January batch for known Microsoft Word flaws that are currently under 

The Redmond, Wash., software maker released four bulletins with patches 
for a total of 10 vulnerabilities, most rated "critical," but there is 
no sign of fixes for the known code-execution Word bugs that have been 
exploited in zero-day attacks since December 2006. 

Microsoft originally planned to ship eight bulletins this month but four 
were pulled at the eleventh hour, suggesting that there were problems 
with the quality of the updates. One of the bulletins that was withdrawn 
was slated to address Microsoft Office flaws, but it is not clear if 
Word fixes were included.

The company's security response team has officially confirmed that at 
least three undocumented Word vulnerabilities are being used in 
code-execution attacks against select targets.

The first confirmed Windows Vista flaw, a denial-of-service issue that 
was publicly released on an underground hacker site in Russia, also 
remains unpatched. 

Excel and Outlook patches

The bulk of the January patcheseight out of 10address holes in Excel and 
Outlook, the spreadsheet and e-mail clients that ship as part of the 
Microsoft Office suite. 

There are five patches in MS07-002, all covering "remote code execution" 
vulnerabilities in Excel. The flaws could be used by an attacker to take 
"complete control" of a victim's computer, Microsoft warned.

Three separate patches have been released in MS07-003 to cover gaping 
holes in Outlook. Two of the three flaws can cause remote code execution 
attacks, Microsoft said. 

A third "critical" bulletin, MS07-004, addresses a code execution issue 
in the VML (Vector Markup Language) implementation in Microsoft Windows.

This is the second major VML flaw to haunt Windows users in recent 
months. In September 2006, attackers targeted a Windows VML 
implementation bug to plant rootkits and spyware programs on vulnerable 
machines, forcing Microsoft to respond with an out-of-cycle Internet 
Explorer patch.

Microsoft's January patch batch also includes MS07-001, which addresses 
an "important" vulnerability in the Microsoft Office 2003 Brazilian 
Portuguese Grammar Checker. 

Subscribe to InfoSec News

This archive was generated by hypermail 2.1.3 : Tue Jan 09 2007 - 22:22:08 PST