Close
  • Latest News
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
Read Down
Sign in
Close
Welcome!Log into your account
Forgot your password?
Read Down
Password recovery
Recover your password
Close
Search
Logo
Logo
  • Latest News
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
More
    Home Cybersecurity
    • Cybersecurity

    MS First Look: Word 2007 Not Bitten by Bugs

    By
    Brian Prince
    -
    April 11, 2007
    Share
    Facebook
    Twitter
    Linkedin

      Microsoft says a preliminary investigation into reports of vulnerabilities in its Office 2007 suite has produced no evidence of a threat to users.

      Reports of new security holes in MS Office have been made public on known exploit sites, including information about four bugs posted on one site. Microsoft has not released specific information about the vulnerabilities, citing potential risk to users.

      “Microsofts initial investigation has found that none of these claims demonstrate any vulnerability in Word 2007 or any Office 2007 products,” a company spokesperson said April 11. “Our investigation into the possible impact of these claims on other versions of Microsoft Office is continuing.”

      The reported flaws were uncovered by Mati Aharoni of Offensive-Security.com, in Israel. He said he was not searching for vulnerabilities in Word, but stumbled upon them while developing Offensive-Security.com course materials.

      “I ran a character substitution script on several Windows file formats and was left dazed by the results,” he said. “The vulnerabilities I released to the public were the least dangerous of my findings—most resulted in DOS only—actually getting code to execute via these bugs is highly improbable.”

      Two of these documents show how Word 2007 could trigger a “CPU exhaustion.” A third vulnerability, also concerning Word 2007, could supposedly allow remote code execution. The fourth alleged vulnerability, which concerns the “.hlp” extension for Windows help files, could cause a heap overflow condition.

      /zimages/2/28571.gifFor advice on how to secure your network and applications, as well as the latest security news, visit Ziff Davis Internets Security IT Hub.

      Aharoni said he has received several messages from others confirming that the bugs crashed Word 2007. He posted screenshots of the crashes or CPU exhaustion conditions on his blog, and expressed confusion as to why Microsoft seems unable to reproduce the conditions.

      Through the company spokesperson, Microsoft stated the company may issue a security advisory or update if it is deemed necessary.

      /zimages/2/28571.gifClick here to read more about the reports of Microsoft Word vulnerabilities being posted on exploit sites.

      Karthik Raman, a researcher at McAfee, in Santa Clara, Calif., wrote in a blog post April 10 that the timing of publicizing of the potential vulnerabilities on exploit sites may not be coincidental. “This is yet another time that zero-day flaws have been published around a Patch Tuesday, possibly to maximize the publics exposure to these flaws until the next months Patch Tuesday,” Raman wrote.

      Andrew Storms, director of security operations at nCircle, in San Francisco, said the issue of responsible disclosure is a never-ending debate within the security space. He advocates responsible disclosure, defined as reporting a vulnerability to a vendor first and allowing the company a chance to fix it.

      “It comes down to the question, Does responsible disclosure to the vendor deliver a better product? Does it force the vendor to fix it more quickly?” he said.

      Aharoni said he has little patience for the formal disclosure process after having had disappointing experiences with it in the past.

      “Microsoft has made huge leaps in security in the past years and I appreciate that,” he said. However, he said, “As a Microsoft customer, I would like to see bugs patched quicker.”

      Check out eWEEK.coms Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEKs Security Watch blog.

      Brian Prince

      MOST POPULAR ARTICLES

      Big Data and Analytics

      Alteryx’s Suresh Vittal on the Democratization of...

      James Maguire - May 31, 2022 0
      I spoke with Suresh Vittal, Chief Product Officer at Alteryx, about the industry mega-shift toward making data analytics tools accessible to a company’s complete...
      Read more
      Cybersecurity

      Visa’s Michael Jabbara on Cybersecurity and Digital...

      James Maguire - May 17, 2022 0
      I spoke with Michael Jabbara, VP and Global Head of Fraud Services at Visa, about the cybersecurity technology used to ensure the safe transfer...
      Read more
      Applications

      Cisco’s Thimaya Subaiya on Customer Experience in...

      James Maguire - May 10, 2022 0
      I spoke with Thimaya Subaiya, SVP and GM of Global Customer Experience at Cisco, about the factors that create good customer experience – and...
      Read more
      Big Data and Analytics

      GoodData CEO Roman Stanek on Business Intelligence...

      James Maguire - May 4, 2022 0
      I spoke with Roman Stanek, CEO of GoodData, about business intelligence, data as a service, and the frustration that many executives have with data...
      Read more
      Cloud

      Yotascale CEO Asim Razzaq on Controlling Multicloud...

      James Maguire - May 5, 2022 0
      Asim Razzaq, CEO of Yotascale, provides guidance on understanding—and containing—the complex cost structure of multicloud computing. Among the topics we covered:  As you survey the...
      Read more
      Logo

      eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site’s focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

      Facebook
      Linkedin
      RSS
      Twitter
      Youtube

      Advertisers

      Advertise with TechnologyAdvice on eWeek and our other IT-focused platforms.

      Advertise with Us

      Menu

      • About eWeek
      • Subscribe to our Newsletter
      • Latest News

      Our Brands

      • Privacy Policy
      • Terms
      • About
      • Contact
      • Advertise
      • Sitemap
      • California – Do Not Sell My Information

      Property of TechnologyAdvice.
      © 2022 TechnologyAdvice. All Rights Reserved

      Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.

      ×