'Highly critical' security flaw in Office - MS Word ?!

'Highly critical' security flaw in Office - MS Word ?!

offline
  • SVITAC 
  • Legendarni građanin
  • Pridružio: 28 Apr 2003
  • Poruke: 5919
  • Gde živiš: Beograd

9.10.2004 09:34:48

Ina Fried
CNET News.com
October 08, 2004, 08:45 BST

A vulnerability has been found in a Microsoft's popular Office Suite - MS Word in particular - that could give a malicious third party control of your machine

A security company warned on Thursday that a flaw in Microsoft Office could allow a denial-of-service attack to be executed on systems running somewhat older versions of the popular productivity suite.

Secunia issued an advisory saying a buffer overrun flaw has been found in Office 2000, and potentially also in Office XP, that could allow hackers to take over a user's system. The company rated the flaw as "highly critical."

The security firm said that vulnerability is caused by an error in the way Microsoft Word manages input when parsing document files. It said the flaw could be exploited through a specially-crafted document and recommends that, until a fix is found, users only open trusted Word documents.

Microsoft said it was investigating the issue, but also took to task the bug's discoverer -- which Secunia identified only as "HexView" -- for not bringing it to Microsoft's attention before going public.

"We have not been made aware of any active exploits of the reported vulnerabilities or customer impact at this time, but we are aggressively investigating the public reports," a Microsoft representative said in an email. But the software maker said it was concerned that it had not been made aware of the flaw prior to it being made public.

"Microsoft is concerned that this new report of a vulnerability in Word was not disclosed responsibly, potentially putting computer users at risk," the representative said. "We believe the commonly accepted practice of reporting vulnerabilities directly to a vendor serves everyone's best interests, by helping to ensure that customers receive comprehensive, high-quality updates for security vulnerabilities with no exposure to malicious attackers while the patch is being developed."

Some in the security community have taken Microsoft to task for the time it takes to develop patches.

Microsoft said that once it completes its investigation, it will decide what, if any, action to take. Options include a fix as part of the company's regular monthly patch releases or an unscheduled fix if the vulnerability warrants it.



Registruj se da bi učestvovao u diskusiji. Registrovanim korisnicima se NE prikazuju reklame unutar poruka.
Ko je trenutno na forumu
 

Ukupno su 1258 korisnika na forumu :: 43 registrovanih, 7 sakrivenih i 1208 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: A.R.Chafee.Jr., Areal84, Asparagus, bladesu, BORUTUS, Brana01, CikaKURE, Dimitrije Paunovic, Dorcolac, DPera, draganl, dushan, GandorCC, Georgius, Hexe, hyla, ikan, Karla, kihot, krkalon, kuntalo, ljuba, markF, mercedesamg, mgolub, milenko crazy north, Milometer, Milos ZA, MilosKop, Miroljub1979, Mixelotti, nemkea71, nextyamb, nick79, procesor, raptorsi, sasa87, shone34, Srle993, vathra, W123, zlaya011, 79693