No Fixes for Microsoft Word Zero-Day FlawsBy Ryan Naraine | Posted 2007-01-09 Email Print
Re-Thinking HR: What Every CIO Needs to Know About Tomorrow's Workforce
Patch Tuesday brings four security bulletins and 10 patches, but still no sight of fixes for code execution holes in Microsoft Word that are under attack.Microsoft has released high-priority fixes for serious vulnerabilities in its Outlook and Excel applications, but there are no patches in the January batch for known Microsoft Word flaws that are currently under attack.
The Redmond, Wash., software maker released four bulletins with patches for a total of 10 vulnerabilities, most rated "critical," but there is no sign of fixes for the known code-execution Word bugs that have been exploited in zero-day attacks since December 2006.
Microsoft originally planned to ship eight bulletins this month but four were pulled at the eleventh hour, suggesting that there were problems with the quality of the updates. One of the bulletins that was withdrawn was slated to address Microsoft Office flaws, but it is not clear if Word fixes were included.
Excel and Outlook patches
The bulk of the January patcheseight out of 10address holes in Excel and Outlook, the spreadsheet and e-mail clients that ship as part of the Microsoft Office suite.
There are five patches in MS07-002, all covering "remote code execution" vulnerabilities in Excel. The flaws could be used by an attacker to take "complete control" of a victim's computer, Microsoft warned.
Three separate patches have been released in MS07-003 to cover gaping holes in Outlook. Two of the three flaws can cause remote code execution attacks, Microsoft said.
A third "critical" bulletin, MS07-004, addresses a code execution issue in the VML (Vector Markup Language) implementation in Microsoft Windows.
This is the second major VML flaw to haunt Windows users in recent months. In September 2006, attackers targeted a Windows VML implementation bug to plant rootkits and spyware programs on vulnerable machines, forcing Microsoft to respond with an out-of-cycle Internet Explorer patch.
Microsoft's January patch batch also includes MS07-001, which addresses an "important" vulnerability in the Microsoft Office 2003 Brazilian Portuguese Grammar Checker.