MS Word Vulnerabilities Reported on Exploit Sites

Apr 11, 2007

Microsoft says it has found no attacks attempting to exploit the reported Office vulnerabilities, but it is continuing to investigate.

Microsoft is investigating public reports of vulnerabilities in Microsoft Office.

Reports of several new security holes in Microsoft Office have been made public on known exploit sites. The company did not release specific information about the vulnerabilities, citing potential risk to users.

"Microsoft is not aware of any attacks attempting to use the reported vulnerability or of customer impact at this time," said a spokesperson for the company, based in Redmond, Wash. "Microsoft will continue to investigate the public reports to help provide additional guidance for customers as necessary."

Postings about the vulnerabilities indicate that exploitation could lead to a program crash or the execution of arbitrary code.

Amol Sarwate, manager of vulnerability research at Qualys, a provider of on-demand security risk and compliance management solutions, based in Redwood Shores, Calif., said the widespread use of Microsoft Word makes the vulnerabilities even more threatening.

"Considering the prevalence of Microsoft Word, the fact that these vulnerabilities target unsuspecting users and also the consequence - total compromise of the system - I would say these vulnerabilities are very serious," Sarwate said. "In addition, zero-day targeted attacks - for CVE-2007-0870 - have amplified the need for a patch."

However, Sarwate added it is important to differentiate between proof-of-concept code and exploit code. "When POC - zero-day - code exists, is does raise the concern, but does not necessarily mean that exploit code will be released or that people will be exploited," he said.

Copyright 2007 by Ziff Davis Media, Distributed by United Press International

Explore further: Expats try phones, social apps to connect to quake-hit Nepal

Related Stories

Big browsers fall in Pwn2Own exploit competition

Mar 22, 2015

Name any of the big browsers and there's an exploit for it. All four major browsers fell down during the Pwn2Own hacking competition running concurrently with the CanSecWest 2015 Conference in Vancouver, ...

Internet Explorer 11 vulnerability allows policy bypass

Feb 05, 2015

(Phys.org) —"Your authentication cookies could be up for grabs in the latest Internet Explorer 11 vulnerability," said Kareem Anderson in WinBeta on Wednesday. The targets are IE 11 on both Windows 7 and 8.1. ...

Giving web developers tools to protect their sites and users

Feb 06, 2015

Most Internet users know that practicing good online hygiene – never clicking on spam, choosing strong passwords and setting up two-factor authentication – is essential for protecting their personal information. They ...

Recommended for you

Google's Waze app to alert kidnappings in LA

Apr 22, 2015

Alerts about hit-and-runs and kidnappings in Los Angeles will soon pop up on traffic app Waze, along with road closure information, the West Coast city's mayor said.

User comments : 0

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.