No Fixes for Microsoft Word Zero-Day Flaws

Microsoft has released high-priority fixes for serious vulnerabilities in its Outlook and Excel applications, but there are no patches in the January batch for known Microsoft Word flaws that are currently under attack.

The Redmond, Wash., software maker released four bulletins with patches for a total of 10 vulnerabilities, most rated “critical,” but there is no sign of fixes for the known code-execution Word bugs that have been exploited in zero-day attacks since December 2006.

Microsoft originally planned to ship eight bulletins this month but four were pulled at the eleventh hour, suggesting that there were problems with the quality of the updates. One of the bulletins that was withdrawn was slated to address Microsoft Office flaws, but it is not clear if Word fixes were included.

The company’s security response team has officially confirmed that at least three undocumented Word vulnerabilities are being used in code-execution attacks against select targets.

The first confirmed Windows Vista flaw, a denial-of-service issue that was publicly released on an underground hacker site in Russia, also remains unpatched.

For advice on how to secure your network and applications, as well as the latest security news, visit Ziff Davis Internet’s Security IT Hub.

Excel and Outlook patches

The bulk of the January patches—eight out of 10—address holes in Excel and Outlook, the spreadsheet and e-mail clients that ship as part of the Microsoft Office suite.

There are five patches in MS07-002, all covering “remote code execution” vulnerabilities in Excel. The flaws could be used by an attacker to take “complete control” of a victim’s computer, Microsoft warned.

Three separate patches have been released in MS07-003 to cover gaping holes in Outlook. Two of the three flaws can cause remote code execution attacks, Microsoft said.

A third “critical” bulletin, MS07-004, addresses a code execution issue in the VML (Vector Markup Language) implementation in Microsoft Windows.

This is the second major VML flaw to haunt Windows users in recent months. In September 2006, attackers targeted a Windows VML implementation bug to plant rootkits and spyware programs on vulnerable machines, forcing Microsoft to respond with an out-of-cycle Internet Explorer patch.

Microsoft’s January patch batch also includes MS07-001, which addresses an “important” vulnerability in the Microsoft Office 2003 Brazilian Portuguese Grammar Checker.

Check out eWEEK.com’s Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at Ryan Naraine’s eWEEK Security Watch blog.