Microsoft sounds bug alarm, confirms Windows-Word attacks

Promises patch to plug hole that's been exploited for weeks

Microsoft yesterday warned of a critical vulnerability that affects users of Word running on Windows 2000 , XP and Server 2003 SP1 -- several weeks after one security company first reported an exploit and a day after a second vendor confirmed ongoing attacks.

In an advisory posted Friday, Microsoft acknowledged "public reports of very limited, targeted attacks" that exploit a bug in the Microsoft Jet Database Engine, a Windows component that provides data access to applications including Microsoft Access and Visual Basic.

According to Symantec, however, the attacks Microsoft described used malicious Word 2000, 2002, 2003 and 2007 documents, which in turn call up the vulnerable Jet .dll.

"We believe that the issue being described [by Microsoft] is one described on March 20, 2008 by Elia Florio of Symantec Security Response," the security firm told customers of its DeepSight threat analysis network on Saturday. "He notes a recent discovery, by Panda Security, of a possible zero-day exploit observed in the wild."

Panda researcher Ismael Briones had blogged about the vulnerability nearly three weeks ago, but said Microsoft had dismissed his report of an in-the-wild exploit. "Microsoft replied that they would not fix these mdb vulnerabilities, as it seems they will not acknowledge vulnerabilities which are from .mdb files," Briones said in his March 3 post.

"You appear to be reporting an issue with a file type Microsoft considers to be unsafe. Many programs, such as Internet Explorer and Outlook, automatically block these files," Briones reported Microsoft as telling him in its e-mailed response.

Last week, however, Symantec researchers analyzed an exploit that circumvented the .mdb file format blocking in Outlook by simply renaming the file to a format the e-mail client accepted. "In fact, it is possible to call msjet40.dll directly from Word, without using Access at all," claimed Symantec's Florio in a Thursday post. "In this attack, the .doc file uses mail-merge functionalities to import an external data source file and so it effectively forces Jet to load the malicious Access sample."

Florio also noted that there are at least two unpatched bugs in Jet that have been exploited by hackers. One of those bugs was reported three years ago.

Microsoft said that users running Word on machines powered by Windows Vista and Windows Server 2003 SP2 are not at risk because those operating systems include a different version of Jet.

Although Microsoft downplayed the threat, spokesman Bill Sisk confirmed that a patch was on the way. "We currently have teams working to develop an update of appropriate quality for release in our regularly scheduled bulletin process or as an out-of-band update, depending on customer impact," he said in a post to the Microsoft Security Response Center's blog.

Until a fix is available, Microsoft said users and IT administrators could disable Jet or block .mdb files at the gateway.

The next scheduled Microsoft patch day is Tuesday, April 8.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?