Huge vulnerability in Word, says Microsoft
Posted by: Timothy Weaver on 03/25/2014 11:25 AM
[
Comments
]
Microsoft warned Monday that a newly discovered Microsoft Word vulnerability is being used by hackers to gain remote access of your PC. All it takes is opening or merely previewing a malicious email using Outlook's default settings.
As you may know, Word is the default viewer for Outlook 2007, 2010, and 2013.
So far, Microsoft is aware of the limited attack against Word 2010, but the vulnerability exists in Word 2013, Word 2013 RT, Word 2007, Word 2003, Microsoft Office for Mac 2011, and related programs like Word Compatibility Viewer and Word Automation Services on Microsoft SharePoint Server.
Microsoft issued a fix, but it is a destructive method that just bars all RTFs.
A work around is in the offing:
• Configure Outlook to read emails in plain text.
• Try to stay away from RTF files, but if you have to open one, scan it with security software first. This should be standard security practice for all downloads.
• Use a limited account in Windows, rather than an Administrator account, for your day-to-day PC usage. That way the attacker receives far more limited access to your machine if you do become infected. In fact, this one simple trick can make your PC virtually invulnerable.
• Microsoft says running its Enhanced Mitigation Experience Toolkit (EMET) can also protect against the exploit, as is often the case with zero-day attacks.
Note that the exploit also involves Word 2003, which will see its end of life at the same time that MS stops supporting XP.
As you may know, Word is the default viewer for Outlook 2007, 2010, and 2013.
So far, Microsoft is aware of the limited attack against Word 2010, but the vulnerability exists in Word 2013, Word 2013 RT, Word 2007, Word 2003, Microsoft Office for Mac 2011, and related programs like Word Compatibility Viewer and Word Automation Services on Microsoft SharePoint Server.
Microsoft issued a fix, but it is a destructive method that just bars all RTFs.
A work around is in the offing:
• Configure Outlook to read emails in plain text.
• Try to stay away from RTF files, but if you have to open one, scan it with security software first. This should be standard security practice for all downloads.
• Use a limited account in Windows, rather than an Administrator account, for your day-to-day PC usage. That way the attacker receives far more limited access to your machine if you do become infected. In fact, this one simple trick can make your PC virtually invulnerable.
• Microsoft says running its Enhanced Mitigation Experience Toolkit (EMET) can also protect against the exploit, as is often the case with zero-day attacks.
Note that the exploit also involves Word 2003, which will see its end of life at the same time that MS stops supporting XP.
Comments
