MS First Look: Word 2007 Not Bitten by Bugs

April 12, 2007
Microsoft Office Logo

Microsoft says it is still investigating reports of posted security holes, but it has found no evidence that the Office 2007 suite is vulnerable to the reported flaws.

Microsoft says a preliminary investigation into reports of vulnerabilities in its Office 2007 suite has produced no evidence of a threat to users.

Reports of new security holes in MS Office have been made public on known exploit sites, including information about four bugs posted on one site. Microsoft has not released specific information about the vulnerabilities, citing potential risk to users.

"Microsoft's initial investigation has found that none of these claims demonstrate any vulnerability in Word 2007 or any Office 2007 products," a company spokesperson said April 11. "Our investigation into the possible impact of these claims on other versions of Microsoft Office is continuing."

The reported flaws were uncovered by Mati Aharoni of Offensive-Security.com, in Israel. He said he was not searching for vulnerabilities in Word, but stumbled upon them while developing Offensive-Security.com course materials.

"I ran a character substitution script on several Windows file formats and was left dazed by the results," he said. "The vulnerabilities I released to the public were the least dangerous of my findings - most resulted in DOS only - actually getting code to execute via these bugs is highly improbable."

Two of these documents show how Word 2007 could trigger a "CPU exhaustion." A third vulnerability, also concerning Word 2007, could supposedly allow remote code execution. The fourth alleged vulnerability, which concerns the ".hlp" extension for Windows help files, could cause a heap overflow condition.

Aharoni said he has received several messages from others confirming that the bugs crashed Word 2007. He posted screenshots of the crashes or CPU exhaustion conditions on his blog, and expressed confusion as to why Microsoft seems unable to reproduce the conditions.

Through the company spokesperson, Microsoft stated the company may issue a security advisory or update if it is deemed necessary.

Karthik Raman, a researcher at McAfee, in Santa Clara, Calif., wrote in a blog post April 10 that the timing of publicizing of the potential vulnerabilities on exploit sites may not be coincidental. "This is yet another time that zero-day flaws have been published around a Patch Tuesday, possibly to maximize the public's exposure to these flaws until the next month's Patch Tuesday," Raman wrote.

Andrew Storms, director of security operations at nCircle, in San Francisco, said the issue of responsible disclosure is a never-ending debate within the security space. He advocates responsible disclosure, defined as reporting a vulnerability to a vendor first and allowing the company a chance to fix it.

"It comes down to the question, Does responsible disclosure to the vendor deliver a better product? Does it force the vendor to fix it more quickly?" he said.

Aharoni said he has little patience for the formal disclosure process after having had disappointing experiences with it in the past.

"Microsoft has made huge leaps in security in the past years and I appreciate that," he said. However, he said, "As a Microsoft customer, I would like to see bugs patched quicker."

Copyright 2007 by Ziff Davis Media, Distributed by United Press International

Explore further: UN science report: Warming worsens security woes

Related Stories

UN science report: Warming worsens security woes

March 30, 2014

In an authoritative report due out Monday a United Nations climate panel for the first time is connecting hotter global temperatures to hotter global tempers. Top scientists are saying that climate change will complicate ...

A fresh perspective on internet security

December 21, 2011

People don’t do enough to protect themselves on the Internet. They don’t use good passwords. They’re poor at recognizing the URL of “phishing” sites. They ignore certificate errors.

Sandia helps small security company thwart thieves

May 19, 2015

At a motorcycle shop on a busy city street, crooks devised an elaborate scheme to steal from the storage yard. They jumped the fence and unpacked some newly arrived bikes from crates. They used the crates to build a ramp ...

Google acquires Web security firm reCAPTCHA

September 16, 2009

(PhysOrg.com) -- Google announced on Wednesday that it has acquired reCAPTCHA, a company that produces the squiggly words used by websites to guard against spam and fraud.

Security from chaos

April 16, 2008

There’s safety (and security) in numbers … especially when those numbers are random. That’s the lesson learned from a DHS-sponsored research project out of the University of Southern California (USC). The research is ...

Recommended for you

Firms push hydrogen as top green energy source

January 18, 2017

Over a dozen leading European and Asian firms have teamed up to promote the use of hydrogen as a clean fuel and cut the production of harmful gasses that lead to global warming.

WhatsApp vulnerable to snooping: report

January 13, 2017

The Facebook-owned mobile messaging service WhatsApp is vulnerable to interception, the Guardian newspaper reported on Friday, sparking concern over an app advertised as putting an emphasis on privacy.

0 comments

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.