The Channel logo


By | John Leyden 11th December 2006 12:17

Trojan targets unpatched Word flaw (again)

Double trouble

Microsoft has warned of another unpatched vulnerability in Word. The unspecified code execution flaw means hackers can load malware onto targeted machines providing users are tricked into opening maliciously constructed Word files.

The latest vulnerability in Microsoft's ubiquitous Office application software follows the discovery of a similar - also unpatched - memory corruption bug in Word last week. That flaw affected Mac as well as Windows versions of Word, whereas "this week's bug" is limited to Word 2000, 2002, 2003, and Word Viewer 2003. Both flaws are being exploited in low-intensity Trojan attacks.

As a result of these attacks, Microsoft advises users "not [to] open or save Word files that you receive from un-trusted sources or that you receive unexpectedly from trusted sources". This a pretty strict injunction - which labels the common practice of sending document files by email as inadvisable - at least until Microsoft releases patches to address the flaws.

Unfortunately, Microsoft confirmed last week that this will not happen on its next Patch Tuesday, 12 December, which will see five security patches for Windows (at least one of which is critical) but no Office updates. Word users are unlikely to see a patch until the new year. ®

alert Send corrections


Frank Jennings

What do you do? Use manual typwriters or live in a Scottish croft? Our man advises
A rusty petrol pump at an abandoned gas station. Pic by Silvia B. Jakiello via shutterstock

Trevor Pott

Among other things, Active Directory needs an overhaul
Baby looks taken aback/shocked/affronted. Photo by Shutterstock

Kat Hall

Plans for 2 million FTTP connections in next four years 'not enough'
Microsoft CEO Satya Nadella


League of gentlemen poster - Tubbs and Edward at the local shop. Copyright BBC
One reselling man tells his tale of woe