|
ALARM Group ALERT - click for a description of ALARM, The Computing Alert System
Alert Number: 120606-01
Alert Date: 12/06/06
Alert Title: Zero-day attack circulating for *UNPATCHED* MS word vulnerability
Update-to: None
OS/Platform/Application:
Microsoft Word 2000
Microsoft Word 2002
Microsoft Word 2003
Microsoft Word Viewer 2003
Microsoft Word 2004 for Mac
Microsoft Word 2004 v. X for Mac
Microsoft Works 2004
Microsoft Works 2005
Microsoft Works 2006
Category: ALERT
Severity: HIGH
Attention: Windows and Mac Administrators/Users, Desktop Support Personnel |
Summary: On December 5 2006 Microsoft published security advisory 929433. This advisory details a vulnerability in Microsoft Word that could allow a remote attacker to compromise a victim system. The most likely vector of attack is the opening of a specifically-crafted word document (in the form of an email attachment or content downloaded from a website, etc). No patch has been supplied by the vendor at the time of this writing (~9:15 AM 12/6/006). Multiple Internet security agencies are reporting that this vulnerability is currently being exploited in the wild; as such these agencies are rating this vulnerability as "critical" to
"extremely critical".
Recommended Actions: Microsoft Security Advisory 929433 currently recommends that users do NOT open or save word files that are received unexpectedly from trusted or untrusted resources. MS Word users should read the security advisory and associated reports (links provided below) for more information on the vulnerability and attack vectors.
**Because this type of zero-day activity has the potential to affect home users, readers of this alert are encouraged to share it with friends, family, and associates to help spread awareness of the threat and necessary precautions**.
ITS Actions: No additional specific ITS-wide actions are being undertaken at this time. An update will be issued if the situation changes.
Resources:
Microsoft Security Advisory 929433:
http://www.microsoft.com/technet/security/advisory/929433.mspx
Secunia Advisory:
http://secunia.com/advisories/23232/
FrSirt Advisory:
http://www.frsirt.com/english/advisories/2006/4866
SANS diary article on vulnerability:
http://isc.sans.org/diary.php?storyid=1913
