Microsoft looking into WordPad zero-day flaw
Microsoft is investigating reports of a flaw in the WordPad Text Converter for Word 97 files, the company said on Tuesday. A Microsoft blog stated "we are aware of very limited and targeted attacks seeking to exploit this vulnerability."
On Wednesday security researchers reported finding a zero-day flaw affecting Microsoft Internet Explorer 7.
According to Microsoft Security Advisory 960906, the flaw only affects users of Windows 2000 Service Pack 4, Windows XP Service Pack 2, Windows Server 2003 Service Pack 1, and Windows Server 2003 Service Pack 2. This issue does not affect Windows XP Service Pack 3, Windows Vista, and Windows Server 2008.
When Microsoft Office Word is installed, Word 97 documents are set by default to open using Microsoft Office Word. Microsoft said Word is not affected by this vulnerability. However, an attacker could rename any malicious file to have a Windows Write (.wri) extension; the malicious file could invoke WordPad. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user.
The flaw cannot be exploited automatically through e-mail, however. For an attack to be successful, a user must open an e-mail attachment. Microsoft notes that the .wri file type can be blocked at the Internet perimeter.
Microsoft issued its standard disclaimer stating it is investigating the issue and would act upon completion of that investigation. Among the solutions, Microsoft could issue a service pack, include a bulletin in its next monthly security update, or issue an out-of-cycle security update depending on the severity of the issue.
As CNET's resident security expert, Robert Vamosi has been interviewed on the BBC, CNN, MSNBC, and other outlets to share his knowledge about the latest online threats and to offer advice on personal and corporate security. Listen to his podcast at securitybites.cnet.com or e-mail Robert with your questions and comments. 
Might want to try to go for something a little more mainstream.
Microsoft engineers developing a virus... they have better things to do.
- by timber2005 December 11, 2008 8:58 AM PST
- The solution to me seems simple.
- Like this Reply to this comment
-
(11 Comments)If they are using Win2000, Sever 2003 (any SP), Microsoft needs to put out an extra security update to patch the flaw.
If they are using XP (SP0-SP2), tell them to upgrade to SP3. It's been out a year, time to move up.
Though taking the bits out of SP3 and making them a patch for this wouldn't be hard, it just seems redundant when someone does upgrade to SP3. Its supposed to be a rollup of patches and other fixes, not a bunch of fixes cut up for users who can't commit to the full package. (It does help companies though).