New security flaw in MS Word

[Special_K]

it's not exactly OC news, but you guys should know about this fyi



Microsoft on Dec. 5 warned that an unpatched vulnerability in its Word software program is being used in targeted, zero-day attacks.

A security advisory from the Redmond, Wash., company said the flaw can be exploited if a user simply opens a rigged Word document.

There are no pre-patch workarounds available. Microsoft suggests that users "not open or save Word files," even from trusted sources.

http://www.eweek.com/article2/0,1895,2068786,00.asp


MS advisory (http://www.microsoft.com/technet/security/advisory/929433.mspx)

[[XC] itznfb]

Yea, as a Network Administrator I can tell you their solution to "not open or save Word files" is NOT AN OPTION for a business.

[kromosto]

return of notepad

[gOJDO]

allready did.

[Bergo]

open office? :P

[[XC] itznfb]

Think of all the businesses that use MS Outlook to open E-Mail. No one can send, receive or even open E-Mail. Yea, imagine your a Network Admin and you tell your CEO no employee can use Outlook or Word today. I'd get fired on the spot.

[Eastcoasthandle]

use google (https://www.google.com/accounts/ServiceLogin?service=writely&passive=true&continue=http%3A%2F%2Fdocs.google.com%2F&ltmpl=WR_tmp_2_lfty&nui=1&utm_campaign=en&utm_source=en-ha-na-us-google&utm_medium=ha&utm_term=google%20office)

[RaZz!]

Yea, as a Network Administrator I can tell you their solution to "not open or save Word files" is NOT AN OPTION for a business.

especially the following sentence made me laugh:

Microsoft has tested the following workarounds. While these workarounds will not correct the underlying vulnerability, they help block known attack vectors. When a workaround reduces functionality, it is identified in the following section.

• Do not open or save Word files



yeah, it seems they did a lot of testing, didn't they? :P

[Johnny Bravo]

yeah I think thats a bit of a sweeping comment. Perhaps don't open MS word files from strangers......

[djgandy]

How do i save all the work i just done?

[Shon]

Office 2007 it's no reported affected ;)

[Starscream]

yeah I think thats a bit of a sweeping comment. Perhaps don't open MS word files from strangers......

including the ones in e-mails that promise me a gazzilion dollars or penis and breasts enlargement?

i mostly use notepad anyway if i have notes to email around. Its way faster then word when u just have to type some things down and everybody has Notepad on their PC.

[awdrifter]

Office 2007 it's no reported affected ;)

Will it be affected if I save the files in 97-03 compatibility mode?

[3NZ0]

Thank god i have been using 2007 for ages then :)

[[XC] Teroedni]

Gedit ,nano, notepad or Abiword:toast:
None of which are affected by this ms bug.

[ahmad]

That a seems a bit ridicioulus. Why the heck would Microsoft tell people not to open MS Word files? This warning makes little sense. Something is up...

[nn_step]

umm stupid little fact for everyone, turn off micros or Switch to RTF

[perkam]

OpenOffice Window Repair Solutions
http://blogs.ipswitch.com/archives/broken%20window.jpg
Experts that know that broken windows has more to do with "when", than "if". :up:

Perkam

[Rmc[AZ]]

open office? :P

Yes OpenOffice is the be all, end all for secure word processing. :rolleyes:

[nn_step]

']Yes OpenOffice is the be all, end all for secure word processing. :rolleyes:
ROFL :lol:
I don't care how secure OpenOffice may seem. But if you enable Macros and use .DOC files. You might as well stick with Microsoft Word

[Thorry]

Yeah any file format that uses some kind of active content like macros (or javascript like in quicktime and PDF) is vunerable.

The MS website reads:

"Do not open or save Word files that you receive from un-trusted sources or that you receive unexpectedly from trusted sources. This vulnerability could be exploited when a user opens a specially crafted Word file."

So they don't tell you not to open or save Word files, that's just stupid..
If it was on the website somebody prolly clicked the save button a tad too soon.

No news really, you shouldn't open stuff from untrusted sources, that's true with everything.

Also: Don't go crying when you are using Open Office and it's vunerable as well.. there is no real way to test this so don't say Open Office is safe when you really don't know.

[safan80]

MS word is an un-trusted source in my book.

[[XC] leviathan18]

office >>>>>>>>>>>>>>>>>>>>> open office

[SparkyJJO]

office >>>>>>>>>>>>>>>>>>>>> open office
QFT x100000

[Thorry]

Please show me proof that this new exploit doesn't work on open office...

Anybody who thinks Open Office even comes close to a replacement for Office is downright stupid.

Open Office is nice for home users who only use Word and maybe some Excel.

However professional users who use more then just Word and Excel, or use some of the more advanced features of Word or Excel cannot use Open Office because a lot of the functionality simply isn't there.

The Office package has been in development since 1989 now and includes 11 mayor applications. It also features tons of tools, add-ons and usefull resources.

Each of the mayor products has complete departments working on it full-time.
The Office suite is one of Microsofts biggest and best products.

Open Office has been in development since 2000 and based upon code starting development in 1994. The development has been stopped and started a few times and there are now very little people working full-time on this software package (compared to the amount of people working on Microsoft Office).

It includes only 5 mayor applications and comes nowhere near the tools, features and resources provided by Microsoft Office.

If OpenOffice were to provide simular functionality to Microsoft Office a lot of companies would migrate to OpenOffice, but this is simply not the case.

As for home users: Yeah if you only use Word once in a while OpenOffice is fine.
However the home users are a very small piece of the pie, and most of them use the software illegal anyways. The home market is also in the hands of the OEMs which always sell you an Microsoft Office license whether you want to or not.

Open Office maybe a good alternative some day, but thinking that day is today is just wishfull thinking..

[nn_step]

Honestly Thorry, Openoffice is wonderful for what you pay for, if your lively hood depends on word documents your going to pay top dollar for the best product on Earth for Word documents. Be it $100 or $1,000.
OpenOffice on the other hand is wonderful for the majority of users since all they need is the ability to write, print, and share text. Most of the features aren't used.

[Thorry]

Honestly Thorry, Openoffice is wonderful for what you pay for, if your lively hood depends on word documents your going to pay top dollar for the best product on Earth for Word documents. Be it $100 or $1,000.
OpenOffice on the other hand is wonderful for the majority of users since all they need is the ability to write, print, and share text. Most of the features aren't used.

That's true, but that's for non-business users only.

Most people just get Office or Works with their PC and don't really care about anything.

Most people would react like this: "Ow no a virus.. ah well better reinstall"
And they put in their vendor CD, get a cup of coffee and 20 mins later there all good to go.

Also: Companies really don't care how much software costs.
For smaller companies it's tax deductable so they rather give it to the software company then to the government, and for the bigger companies Microsoft has really good prices.