Third MS Word Code Execution Exploit Posted

Exploit code for yet another unpatched vulnerability in Microsoft Word has been posted on the Internet.

Exploit code for a third, unpatched vulnerability in Microsoft Word has been posted on the Internet, adding to the software makers struggles to keep up with gaping holes in its popular word processing program.

The attack code, available at Milw0rm.com, contains sample Word documents that have been rigged to launch code execution exploits when the file is opened.

Microsoft has not yet publicly acknowledged the vulnerability, but the United States Computer Emergency Readiness Team issued an alert to warn that Word documents can be manipulated to trigger code execution of denial-of-service attacks.

"Data used by Microsoft Word to construct a destination address for a memory copy routine is embedded within a Word document itself. If an attacker constructs a Word document with a specially crafted value used to build this destination address, then that attacker may be able to overwrite arbitrary memory," the US-CERT warned.

An attacker could trigger the vulnerability by convincing a user to open a rigged Word document. Because exploit code is publicly available, the risk of a widespread attack is heightened.

The exploit was first posted on Dec. 12. At press time, anti-virus coverage for malware that might exploit this bug is largely nonexistent. According to Beyond Securitys SecuriTeam, only one vendor, BitDefender, was detecting the proof-of-concept as a threat.

Resource Library:

In the absence of a patch from Microsoft, US-CERT recommends:

Do not open unfamiliar or unexpected Word or other Office documents, particularly those hosted on Web sites or delivered as e-mail attachments.

Do not rely on file-name extension filtering. In most cases, Windows will call Word to open a document even if the document has an unknown file extension. For example, if document.qwer contains the correct file header information, Windows will open document.qwer with Word. Filtering for common extensions such as .doc, and .dot will not detect all Word documents.

Disable the automatic opening of Microsoft Office documents. By default, Microsoft Office 97 and Microsoft Office 2000 will configure Internet Explorer to automatically open Microsoft Office documents. This feature can be disabled by using the Office Document Open Confirmation Tool. Mozilla Firefox users should disable automatic opening of files, as specified in the Securing Your Web Browser document.

This is the third code-execution flaw found in Microsoft Word in the last two weeks.

On Dec. 5, the Redmond, Wash., vendor issued a security advisory to warn of targeted zero-day attacks exploiting a Word vulnerability. Software versions affected by that bug include Word 2000, Word 2002, Office Word 2003, Word Viewer 2003, Word 2004 for Mac and Word 2004 v. X for Mac. The Works 2004, 2005 and 2006 suites are also affected because they include Microsoft Word.

Exactly a week later, on Dec. 12, a second vulnerability was discovered during actual code execution attacks against select targets. The second flaw affects Word 2000, Word 2002, Word 2003 and Word Viewer 2003. Word 2007 is not affected.

Microsoft suggests that users "do not open or save Word files," even those that arrive unexpectedly from trusted sources. "As a best practice, users should always exercise extreme caution when opening unsolicited attachments from both known and unknown sources," the company said.

Check out eWEEK.coms Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at Ryan Naraines eWEEK Security Watch blog.

Reader Comments: Third MS Word Code Execution Exploit Posted >>> Be the FIRST to comment on this article!

>>> More Network Security & Hardware Articles          >>> More By Ryan Naraine