Zero-day Word flaw used in attack

by admin May 19, 2006 at 2:52 pm

A new, yet-to-be-fixed security hole in Microsoft Word exposes computer users to cyberattack, Symantec warned Friday.

Would-be intruders already have attempted to compromise PCs at a Japanese government entity by exploiting the flaw, Vincent Weafer, the senior director at Symantec Security Response, said in an interview. In response, Symantec has raised its ThreatCon to Level 2, which means an outbreak is expected.

“What we’re seeing is a continuation of the targeted threat using zero-day vulnerabilities,” Weafer said. (Zero-day flaws are ones for which no patch exists.) “We got it from a single large customer inside Japan. We have not seen anyone else get it.”

Microsoft is readying a security update for Word that repairs this vulnerability, a company representative said in an e-mailed statement. The fix is scheduled to be released as part of the June 13 security updates, or sooner, if warranted, the representative said.

Full story: ZDNet News