SHARE
Facebook X Pinterest WhatsApp

Microsoft Word Zero-Day Attack Discovered

Microsoft’s security response team has launched an investigation into reports of a zero-day attack against a previously unknown vulnerability affecting its ever-present Microsoft Word program. The Redmond, Wash.-based software maker said it’s aware of “very limited attacks” exploiting the reported Word flaw. If the vulnerability—and attack—is confirmed, the company is likely to issue a pre-patch […]

Written By
thumbnail Ryan Naraine
Ryan Naraine
Jan 25, 2007
Channel Insider content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More

Microsoft’s security response team has launched an investigation into reports of a zero-day attack against a previously unknown vulnerability affecting its ever-present Microsoft Word program.

The Redmond, Wash.-based software maker said it’s aware of “very limited attacks” exploiting the reported Word flaw. If the vulnerability—and attack—is confirmed, the company is likely to issue a pre-patch advisory with workarounds or suggested actions or vulnerable customers.

The vulnerability was discovered during an actual live attack by anti-virus vendor Symantec. It affects multiple versions of Microsoft Word and can be used in successful code execution attacks against users of Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP.

According to an advisory from Symantec, the flaw is unrelated to the three previously known Word bugs that remain unpatched.

In the attack scenario discovered by Symantec, a rigged Word document arrives by e-mail with a lure to trick the target into opening the file.

“When the infected Word document is opened, it uses an exploit to drop some files onto the computer. These files are back door Trojans that enable an attacker to gain remote access to your computer,” the company warned.

Click here to read more about Word vulnerabilities.

Once the exploit is launched, the attacker drops a backdoor Trojan on the infected machine and immediately creates a clean Word document named “Summary on China’s 2006 Defense White paper.doc.”

The Trojan then checks for Internet connectivity by visiting various Web sites, such as Microsoft, Google or Yahoo and opens a back door on the compromised computer.

It then connects to the pop.newyorkerworld.com domain on TCP port 80 and uses the command prompt specified instructions to carry out basic operations, Symantec said. These could include logging keystrokes or hijacking sensitive documents and uploading them to a remote server.

“To protect yourself against these threats, do not trust unsolicited files or documents about ‘interesting’ topics. Do not open attachments unless they are expected and come from a known and trusted source,” Symantec warned.

The latest incident closely resembles similar attacks against flaws in Microsoft Office software products, prompting speculation among security researchers that they are closely linked to corporate or even government espionage.

In December 2006, Microsoft confirmed three separate Word flaws that were being used in code-execution attacks against select targets. They remain unpatched.

Check out eWEEK.com’s Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at Ryan Naraine’s eWEEK Security Watch blog.

Recommended for you...

BlackFog & Exertis Enterprise Ink Distribution Deal
Victoria Durgin
Sep 16, 2025
Proofpoint Intros Agentic AI-Based Compliance Offering
Jordan Smith
Sep 16, 2025
Simbian Partnering With Wipro on AI SOC Tech
Jordan Smith
Sep 16, 2025
Eaton Announces Solution to Mitigate AI Power Bursts
Jordan Smith
Sep 15, 2025
Channel Insider Logo

Channel Insider combines news and technology recommendations to keep channel partners, value-added resellers, IT solution providers, MSPs, and SaaS providers informed on the changing IT landscape. These resources provide product comparisons, in-depth analysis of vendors, and interviews with subject matter experts to provide vendors with critical information for their operations.

Property of TechnologyAdvice. © 2025 TechnologyAdvice. All Rights Reserved

Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.