Slashdot Mirror
Microsoft Word Zero-Day Used In Targeted Attacks
wiredmikey (1824622) writes "Microsoft warned on Monday of a remote code execution vulnerability (CVE-2014-1761) in Microsoft Word 2010 that is being actively exploited in targeted attacks. If successfully exploited, an attacker could gain the same user rights as the current user, Microsoft said, noting that users whose accounts are configured to have fewer user rights on the system could be less impacted than accounts with administrative privileges. 'The vulnerability could allow remote code execution if a user opens a specially crafted RTF file using an affected version of Microsoft Word, or previews or opens a specially crafted RTF email message in Microsoft Outlook while using Microsoft Word as the email viewer,' Microsoft explained Microsoft did not share any details on the attacks that leveraged the vulnerability, but did credit Drew Hintz, Shane Huntley, and Matty Pellegrino of the Google Security Team for reporting it to Microsoft."
Last time I looked RTF (decade or so ago) was a pretty bare-bones least-common-denominator document markup specification.
Someone had to do it.
RTF?!
Wasn't RTF supposed to be minimalistic and simple?
RTF is. Word isn't.
Word is bloated, cumbersome and buggy.
A simple protocol, no need for system access.
...
Oh well, MS seems to have found a way to screw that up.
Maybe Bill should pay to fix it
I'm pretty sure nobody would notice or care.
Rich Text Format also includes the possibility hyperlinks and other dynamic media, which means the possibility of handling data/code from foreign sources.
No excuse for system-level access of course, but the potential is there once you start dealing with that.
There are so many of them to choose from
No? Okay, later.
How many years, decades even, has microsoft had the time to understand and get these issues fixed ?
They simply DONT CARE. They retain features like this for their own convenience instead of spending some of those profits on solving the problems these 'easy and vulnerable' solutions of theirs are for.
Thses problems have been identified again and again and whatever bandaids microsoft has done was not a systematic elimination.
Shoddy work with a monopoly is a bad situation and Bill Gates who set the pattern for this company can drink molten gold in hell for the pain he's caused so many people KNOWINGLY.
Where's that M$ shill now?
Did you know that there is a zero-day emacs flaw which allows an attacker to run arbitrary Lisp code??? Scary, I know, much less vim. If Emacs is to overtake Windows, this type of careless programming has to stop.
Society use your Sciences
Privilege escalation is always worse than 'execute with same privileges as user'; but for primarily-end-user software the distinction seems a great deal less helpful (unlike, say, on the server, where attacks isolated to one service account or daemon are legitimately less dangerous). Joe User's security context has access to more or less his entire life in documents and ill-secured website passwords, and enough permission to plant something that will start when he next logs in in a zillion different places that he isn't likely to notice(details will vary by OS; but the only real exception would be the control-freakier mobile ones). So Joe User is screwed at either privilege level, and, from the perspective of fixing the system, conclusively proving that only user-level access was gained and the system is still secure (much less attempting to fix it if it isn't) is so much more time consuming than just nuking it and applying a fresh image that you'd only try in order to get samples of the attacker, not because it's worth the trouble on its own.
Plus OLE support. Quite a powerful capability; but one of those powerful capabilities best handled carefully, kept away from direct sunlight, protected from shocks, and otherwise treated as though it is just waiting to ruin your day.
You have been able to embed OLE objects since 1992.
Help stamp out iliturcy.
Microsoft privilege levels are a joke, I know of two ways to bypass it right now and even worse I've had them since W7 was in beta.. Honestly I'm surprised nobody else has not figured it out, it's so easy it borders on DaFuq. The simple things are usually the best. :P
@cryptolocker Maybe, CryptoLocker can be decrypted in under 10 mins using ollydbg, sadly it's not something your average user can do on their own, but hopefully that changes with the next generation. :(
"As an initial workaround until the bug is PATCHES, Microsoft is providing a Fix it automated tool which uses Office’s file block feature and ADDS FEW registry keys to prevent opening of RTF files in all Word versions. "
Idiot.
Ohh!
Yo pretty ladies around the world
Got a weird thing to show you
So tell all the boys and girls
Tell your brother, your sister
And your mama too
Cause we're about to throw down
And you'll know just what to do
Wave your hands in the air
Like you don't care
Glide by the people as they start to look and stare
Do your dance
Do your dance
Do your dance quick mama, come on baby tell me what's the word
Word up
Everybody say when you hear they call
You've got to get it underway
Word up, it's the code word
No matter where you say it
You'll know that you'll be heard
Now all you sucker DJs
Who think you're fly
There's got to be a reason
And we know the reason why
You try to put on those airs and act real cool
But you've got to realize
That you're acting like fools
Give us music we can use it
We need to dance
We don't have the time
For psychological romance
No romance, no romance
No romance for me, mama
Come on baby tell me what's the word
Word up
Everybody say when you hear the call
You've got to get it underway
Dial "L" for low...
Come on, all you people say...
W-O-R-D up - W-O-R-D up
MS Word has been insecure since MicroShaft decided to add VBA and tie Word into the OS. Nothing but virus attacks and worms.
Why the hell do so many people continue using shit products so damned likely to infect their system?
It has been insecure since day one.
> "Most security professionals consider Microsoft the bar every other vendor should strive to meet."
Computerworld said it, so it must be true.
http://www.computerworld.com/s/article/9246837/Perspective_Microsoft_risks_security_reputation_ruin_by_retiring_XP?pageNumber=2
Because we bloody have to.
I use LibreOffice for my own stuff, but if you want to send your CV to an employer, or want to send an offer or an invoice to a customer, or communicate with the government, or basically send formatted text to anyone in the real world, you'll quickly find that they only accept Word documents. And if LibreOffice's export function breaks the formatting in any way, your CV will go into the trash, the offer won't be considered, the invoice won't be paid, and the government won't process your file and later on sue for non-compliance.
The real world floats on Microsoft Office documents which are processed by average people, i.e. vindictive bastards who are only looking for an excuse to screw you over. Until the time comes when the files LibreOffice exports appear pixel perfect identical in Microsoft Office, using anything other than Word, Excel and Powerpoint is out of the question.
Microsoft said, noting that users whose accounts are configured to have fewer user rights on the system could be less impacted than accounts with administrative privileges.
In other equally surprising news, users who plop their cock on a sturdy table and hit it repeatedly with a tack hammer *could* experience more pain than users who don't.
Thank God we have Microsoft (and Slashdot) to tell us these important and difficult to understand things!
Word !!
Word, bro! You certainly deliver a powerful point there. It seems that you excel in life. If I only could make one note, it would be that I see a great outlook for your future.
Why the hell do so many people continue using shit products so damned likely to infect their system?
Because we aren't all pole-smoking faggots like you. Never had a problem with MS Word, though I have VBA and Active X disabled on my system. Cry somewhere else.
Is that Google is the one exposin the flaws in Microsoft office. I've recently ditched all things Microsoft. Went over to the dark side, Ubuntu. Why not? It has all the applications and functionality I had on my ancient XP laptop plus a whole lot more. Plus it comes bundled with Firefox and Thunderbird which I was using on my XP box to begin with. All I had to do was copy over my documents, music and profiles for both and I got everything back. And Libre office has come a very long way. Plus I have my NNTP reader, my astronomy program, it's all pretty sweet.
The CVE link says that that particular CVE hasn't been assigned yet...
I don't remember the DOS version being particularly insecure.
I use Microsoft Office online with BSD/OS.
You send actual Word documents outside your control? Thanks asking for trouble. Send a PDF.
LOL. Get ye back under your bridge.
MS Word has been insecure since MicroShaft decided to add VBA and tie Word into the OS. Nothing but virus attacks and worms.
Why the hell do so many people continue using shit products so damned likely to infect their system?
File -> Options -> Trust Center ... First thing any sane person should do after installing word is turn off all macros and activex/vba without notification.
And who in the world thinks that Word is usable as an email viewer? It's such a dreadful experience that I'm surprised that MS still offers that option in Outlook.
"Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
That sounds like an apt description of a computer in general. Or dynamite. Or banks. Or the government. Or beer.
The road to tyranny has always been paved with claims of necessity.
Customer wants, company gives. Doesn't matter what the risk is, short term its money in the bank. Most companies work this way. Some care more and prevent sale of a product until it's fit. Others release the product knowing it's go major flaws and leans on the ability to push firmware updates.
Offers? That's the default behaviour in Outlook through Office 2013.
...will it run in Wine?
Office: for when you have Real Work. You know, like managing money, or social security numbers. Medical records. Industrial controls.
Help stamp out iliturcy.
He works at FtMeade and has access to ALL computers. He does not need stinking keys,as he has a Ton Of Exploits to kidnap all keys on all computers.
Well, at least those who ever dare to connect to the outside world by things like ethernet or USB sticks.
But only if you have the power to point to it, I can give you access if you want.
When you sympathize with stupidity, you start thinking like an idiot.