Microsoft contests reports of new Office flaws

LONDON — Microsoft Corp. is disputing reports of new three flaws in its Office software while also taking issue in how the alleged flaws were disclosed.

Several security Web sites reported four new vulnerabilities, three affecting Word 2007, just as Microsoft released its latest round of security patches.

But Microsoft said in a statement Wednesday that none of the three alleged to affect Word 2007 “demonstrate any vulnerability in Word 2007 or any Office 2007 products.”

The company also said it was not notified of the alleged problems before they were publicly disclosed, a practice generally frowned upon in the security industry.

At least two of the Web sites have in the past posted exploit code prior to notifying vendors, said Graham Cluley, senior technology consultant at Sophos PLC.

Two of alleged Word 2007 problems are said to cause CPU (central processing unit) usage to surge to 100 percent, creating a denial-of-service condition, according to a posting on the Security Vulnerabilities Web site. The third vulnerability, also concerning Word 2007, could supposedly allow remote code execution.

The fourth alleged vulnerability, which concerns the “.hlp” extension for Windows help files, could lead to a heap overflow condition, the posting said. Microsoft did not have further information on whether they consider it a vulnerability.

Microsoft issued seven fixes for critical flaws on Tuesday. Hackers have often timed the disclosure of new vulnerabilities just after Microsoft’s patch day, the second Tuesday of the month, to maximize their time to exploit computers, said Greg Day, a security analyst for McAfee Inc.

“It’s becoming a very common trend,” he said.

Security researchers have said that as Microsoft fixes problems within its operating systems, hackers are actively hunting for flaws in its Office applications.

When they find one, hackers will send spam with, for example, a malicious Word document attached. Downloading and opening the file could allow a hacker to take control of the machine. Microsoft has warned that people should not open files sent from unknown sources.

April is proving to be a rough month for Microsoft: It issued an emergency patch on April 3 for an animated cursor flaw, which could let a hacker control a machine after its user merely views a malicious Web site.

IDG News Service

Comment: cdnedit@itbusiness.ca

Would you recommend this article?

Share

Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.


Jim Love, Chief Content Officer, IT World Canada

Featured Download

Related Tech News

CDN in your inbox

CDN delivers a critical analysis of the competitive landscape detailing both the challenges and opportunities facing solution providers. CDN's email newsletter details the most important news and commentary from the channel.