Trojans spread via unpatched Microsoft Word vulnerability

December 07, 2006 Sophos Press Release

Experts at SophosLabs™, Sophos's global network of virus, spyware and spam analysis centers, have warned internet users to take care when opening unsolicited Word documents, following the discovery of Trojan horses being distributed via an unpatched Microsoft security vulnerability.

Microsoft says in a security advisory that it is investigating the vulnerability which appears to allow hackers to launch attacks via Microsoft Word 2000, Microsoft Word 2002, Microsoft Office Word 2003, Microsoft Word Viewer 2003, Microsoft Word 2004 for Mac, and Microsoft Word 2004 v. X for Mac. Microsoft Works 2004, 2005, and 2006 are also affected.

Sophos experts have issued protection against two Trojan horses, Troj/DwnLdr-FXG and Troj/DwnLdr-FXH, which have been seen being distributed via the unpatched flaw.

"It appears that hackers are deliberately creating malformed Word documents that result in a buffer overflow that can then run unauthorized code on the user's computer," said Graham Cluley, senior technology consultant for Sophos. "They can then tell the computer to download and run malware, such as these Trojan horses, opening the door for all kinds of malicious behavior."

At the time of writing Microsoft has published information about the vulnerability on its website, but has not yet issued a patch.

"So far the vulnerability does not appear to be being widely exploited. Nevertheless, Microsoft will be keen to build at patch for the security hole as quickly as possible, and computer users should exercise caution about which Word documents they choose to open," continued Cluley.

Sophos recommends that every IT manager responsible for security should consider subscribing to vulnerability mailing lists such as that operated by Microsoft at www.microsoft.com/technet/security/bulletin/notify.mspx.

Sophos continues to recommend companies protect their desktops and servers with automatically updated anti-virus protection and appropriate firewall defenses.