New Word, Windows Vulnerabilities Surface -- Redmondmag.com

New Word, Windows Vulnerabilities Surface

By Stephen Swoyer
04/13/2007

It's been a rocky 2007 for Microsoft Corp.'s Word productivity app, but April might just be the cruelest month of all. Redmond this week was alerted to a spate of new security flaws in its vulnerability-ridden Word -- only this time, the victim is Microsoft's brand-new Word 2007 application.

Elsewhere, security mailing lists were abuzz with talk of another new Windows vulnerability: a flaw in Microsoft's Windows Help implementation.

The new Word flaws affect only the Office 2007-flavored version of that product. That wasn't the case in February, when Microsoft released a roll-up fix to patch a quartet of vulnerabilities in its Word 2000, Word 2002 (XP), Word 2003 and Word for Macintosh. Several of the vulnerabilities were linked to known zero day attacks. Ironically, Word 2007 was invulnerable to those attacks.

The new flaws, which were disclosed on the Bugtraq mailing list, could make Word 2007 susceptible to Remote Code Execution and denial-of-service (DoS) exploits, according to their discoverer, Israeli security researcher Mati Aharoni. The more serious of the two -- a buffer overflow in Word 2007's WWLIB.DLL -- can allow both DoS and remote code execution attacks, Aharoni claimed.

He also disclosed the possibility of "multiple unspecified vulnerabilities" in Word 2007 that attackers could exploit to cause DoS. Aharoni has developed proof-of-concept code in the form of malicious documents.

Neither issue has yet been confirmed by Microsoft; their status at the Common Vulnerabilities and Exposures (CVE) repository is currently listed as "Under Review."

Little is known about the impact of the Windows Help flaw, which affects files with the .HLP extension. An attacker can exploit it by crafting a malicious .HLP file which -- when executed -- triggers a heap-based buffer overflow. The complete ramifications of doing so are, at present, unknown. A similar issue was identified last year; that vulnerability was linked to a remote code execution exploit.

The most recent Windows Help vulnerability, like the Word 2007 flaws, was identified by Aharoni.

About the Author

Stephen Swoyer is a Nashville, TN-based freelance journalist who writes about technology.

Featured

Cisco Warns of Brute Force Attacks Targeting VPNs and Firewalls

Cisco has revealed that a global increase in brute force attacks targeting Virtual Private Networks (VPNs) and other devices is currently taking place.
What's Inside Microsoft 365's Security Toolbox?

Microsoft provides plenty of native tools to secure Microsoft 365. IT pros just have to know where to look.
Microsoft Kills 30-Day Data Retention Policy for Copilot in Fabric

Microsoft this week announced several usability improvements coming to Copilot in Fabric in preparation of its general availability release later this year.
Using Microsoft Office to Build a Network Diagram 2

Now that we've set up our process, let's dig in with the actual execution.
Microsoft Graph 'Activity Logs' Feature Goes Live

Microsoft announced the general availability of the "activity logs" capability in Microsoft Graph, giving administrators more options to track user activity and identify patterns of potential misuse.