Microsoft Issues Zero-Day Attack Alert For Word

0xbl00d writes "Eweek.com is reporting a new Microsoft Word zero-day attack underway. Microsoft issued a security advisory to acknowledge the unpatched flaw, which affects Microsoft Word 2000, Microsoft Word 2002, Microsoft Office Word 2003, Microsoft Word Viewer 2003, Microsoft Word 2004 for Mac and Microsoft Word 2004 v. X for Mac. The Microsoft Works 2004, 2005 and 2006 suites are also affected because they include Microsoft Word. Simply opening a word document will launch the exploit. There are no pre-patch workarounds or anti-virus signatures available. Microsoft suggests that users 'not open or save Word files,' even from trusted sources."

Comments

Now might be a good time to try ...

[Anonymous Coward]

http://docs.google.com/

Re:Microsoft Recommends..

[mikael]

how on earth can someone code so sloppily that a WORD PROCESSOR has a serious security exploit?!

The usual reason - a local buffer created from the stack set to a fixed size. ie.

char cbuf[MAX_BUFFER];

I would guess that the Microsoft Word document file will be arranged using a chunk data format:
file header followed by object headers with type, version, length, followed by binary data for that object
In this way, unknown chunks can just be skipped over.

It would be no surprise that each programmer coding a particular object (formula, table) would assume that only
they would be theonly one writing read/write routines for their particular object, and choose to use a local stack
buffer to store the raw binary data, before converting it to the internal data structure.

When reading the document, they would just read the header as normal (type,version,length), then read the specified
amount of object data without checking the validity of the length.

And it only takes one programmer to make this mistake in order to create a security vulnerability that compromises
the entire application. Get the right type of data in the Word document, and you could theoretically load and execute
some executable code stored the file.