MS Word Vulnerabilities Reported on Exploit Sites

Microsoft is investigating public reports of vulnerabilities in Microsoft Office.

Reports of several new security holes in Microsoft Office have been made public on known exploit sites. The company did not release specific information about the vulnerabilities, citing potential risk to users.

“Microsoft is not aware of any attacks attempting to use the reported vulnerability or of customer impact at this time,” said a spokesperson for the company, based in Redmond, Wash. “Microsoft will continue to investigate the public reports to help provide additional guidance for customers as necessary.”

/zimages/5/28571.gifFor advice on how to secure your network and applications, as well as the latest security news, visit Ziff Davis InternetsSecurity IT Hub.

Postings about the vulnerabilities indicate that exploitation could lead to a program crash or the execution of arbitrary code.

Amol Sarwate, manager of vulnerability research at Qualys, a provider of on-demand security risk and compliance management solutions, based in Redwood Shores, Calif., said the widespread use of Microsoft Word makes the vulnerabilities even more threatening.

/zimages/5/28571.gifClick hereto read about the last round of zero-day attacks on Microsoft Word.

“Considering the prevalence of Microsoft Word, the fact that these vulnerabilities target unsuspecting users and also the consequence—total compromise of the system—I would say these vulnerabilities are very serious,” Sarwate said. “In addition, zero-day targeted attacks [for CVE-2007-0870] have amplified the need for a patch.”

However, Sarwate added it is important to differentiate between proof-of-concept code and exploit code. “When POC [zero-day] code exists, is does raise the concern, but does not necessarily mean that exploit code will be released or that people will be exploited,” he said.

Check out eWEEK.coms Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEKs Security Watch blog.