Ms Word Unspecified String Handling Memory Corruption

[TCH-Thomas]

Rated extremely critical by Secunia (http://secunia.com/advisories/23950/)

 

Description:

A vulnerability has been reported in Microsoft Word, which can be exploited by malicious people to compromise a user's system.

 

The vulnerability is caused due to an unspecified error when parsing strings in Word documents and can be exploited to corrupt memory thereby allowing execution of arbitrary code on the user's system.

 

NOTE: The vulnerability is currently being actively exploited.

 

The vulnerability is reported in Microsoft Word 2000. Other versions may also be affected.

 

Solution:

Do not open untrusted Office documents.

[TCH-Don]

Thanks Thomas.

[TCH-Bruce]

I never do. But thanks Thomas.

 

To everyone else, if you are going to send a document to someone convert it to a PDF.

[Madmanmcp]

Thanks for sharing Thomas. Not sure why its marked Extremely Critical, it seems to be the same as any of their other vulnerabilities that were found in MS products.

 

In order for this attack to be carried out, a user must first open a malicious Word file attached to an e-mail or otherwise provided to them by an attacker.

 

So if your standard practice is to not open ANY attachments you are safe. And if you only open them from people you trust and are expecting these types of documents from them then the level of infection is low.

 

I'd give it a medium rating to low possibly. But who am I to grade these things

[TCH-Thomas]

Thats probably because many people click on anything that is clickable, and if they say its extremely critical then they have reduced vulnerable machines a little. If they say low/medium, no one cares.