Microsoft fixes zero-day flaws in Word, Office
Twelve security updates from Microsoft fix a range of problems, including a flaw in the Malware Protection Engine and previously-exploited zero-days glitches in Word and Office.
Of the 12 security bulletins Microsoft released, six addressed critical vulnerabilities attackers could exploit to install programs, view, change or delete data; or create new accounts with full user rights.
While it's important to patch the previously-attacked flaws as soon as possible, one security expert said administrators should put the highest priority on the critical MS07-010 bulletin, which fixes a glitch in how the Microsoft Malware Protection Engine parses .pdf files. An attacker could exploit the flaw by constructing a .pdf file that drops malicious code onto the targeted machine when the Malware Protection Engine scans it, Microsoft said.
"The zero-day flaws in Word, Office and the other programs require user interaction to be successfully exploited, but no user interaction is needed for attackers to exploit the Malware Protection Engine flaw," said Amol Sarwate, manager of vulnerability research for Redwood Shores, Calif.-based security firm Qualys. "The software is automatically scanning in the background all the time."
He noted that the engine is used in such Microsoft security tools as Windows Live OneCare, Defender and ForeFront. "This is such a prevalent program that everyone can be affected," he said.
This month's other critical bulletins are:
MS07-008, which fixes a flaw in Windows' HTML Help ActiveX control. An attacker could exploit it by constructing a malicious Web page and luring users there.
MS07-009, which fixes a flawed ADODB.Connection ActiveX control in Microsoft Data Access Components (MDAC).
MS07-014, which fixes six different flaws in Microsoft Word, some of which have already been targeted by attackers in recent months. They include glitches in how the word processing program handles specially-crafted strings and data structures and parses certain files.
MS07-015, which fixes two Microsoft Office flaws that surface when certain files are opened in PowerPoint and Excel.
MS07-016, which fixes two flaws in how the browser instantiates COM objects and one flaw in how it interprets certain responses from FTP servers. Attackers could exploit the COM object flaws by luring users to a malicious Web site. They could exploit the FTP flaw by sending specially crafted responses in an FTP session.
Of this month's important bulletins:
MS07-005 fixes a flaw in how the Step-by-Step Interactive Training program in certain versions of Windows handles bookmark link files. Attackers could exploit it by constructing a specially crafted bookmark link file that could potentially allow remote code execution.
MS07-006 fixes a flaw in how the Windows Shell detects and registers new hardware.
MS07-007 fixes a privilege elevation flaw in Windows XP Service Pack 2, tied to how the Window Image Acquisition Service starts applications.
MS07-011 fixes a flaw in the OLE Dialog component within Windows. An attacker could exploit the flaw when a user interacts with a malformed embedded OLE object within a rich text format (.rtf) file.
MS07-012 fixes a flaw in the MFC component within Windows and Visual Studio. An attacker could exploit it when a user interacts with a malformed embedded OLE object within a .rtf file.
MS07-013 fixes a flaw in the RichEdit components within Windows and Office. An attacker could exploit it when a user interacts with a malformed embedded OLE object within a .rtf file.
