Categories: Software

Attackers Target Unpatched Microsoft Word Flaw

All supported versions of Microsoft Word are vulnerable to an unpatched bug that is being actively exploited to infect users’ systems, two security firms warned over the weekend.

McAfee and FireEye both released advisories warning of the attacks, which make use of an unusual technique that involves booby-trapped Word documents sent to unsuspecting victims.

Malware download

When a user opens the document – specifically, an RTF file with a .doc extension – an OLE2link object embedded in the file causes Word to connect to an attacker-controlled online address and download and execute an HTML application file, researchers said.

The .hta executable bypasses memory-based mitigations put into place by Microsoft and gives attackers the ability to execute arbitrary code on the victim’s system, McAfee said.

The exploit also downloads and displays a fake Word document to the user to conceal a user prompt generated by the OLE2link object, FireEye said.

“The exploit works on all Microsoft Office versions, including the latest Office 2016 running on Windows 10,” McAfee said in an advisory, adding it has seen exploits being carried out since late January.

Patch on the way this week

While Word-based attacks are most commonly carried out using macros, this exploit is unusual in that it makes use of Windows’ Object Linking and Embedding (OLE) feature, researchers said.

McAfee said it identified the attacks on Thursday and decided to release its advisory immediately, which appeared late on Friday.

FireEye said it had previously notified Microsoft of the issue and was coordinating disclosure with the release of a patch, but issued its advisory after the problem was made public.

Microsoft confirmed it is planning to fix the issue in a patch set to be released with its scheduled monthly update on Tuesday.

Experts advised users to avoid opening Word documents from untrusted sources and to apply the patch when it becomes available.

Do you know all about security in 2017? Try our quiz!

Matthew Broersma

Matt Broersma is a long standing tech freelance, who has worked for Ziff-Davis, ZDnet and other leading publications

Recent Posts

EU To Assess Apple’s iPad Compliance Plans

European Commission says it will review Apple's iPad compliance with DMA rules as it seeks…

11 mins ago

James Dyson Says ‘Spiteful’ Budget Will Kill Start-Ups

James Dyson delivers most high-profile criticism so far of Labour's first Budget that raises £40bn…

41 mins ago

Nvidia, Meta Ask Supreme Court To Axe Investor Lawsuits

Nvidia, Meta bring cases before US Supreme Court this month seeking tighter limits on investors'…

1 hour ago

Nvidia To Replace Intel On Dow Jones Industrial Average

Nvidia to replace Intel this week on Dow Jones Industrial Average after years of turmoil…

2 hours ago

Toyota-Backed Joby Flies ‘Air Taxi’ In Japan

Joby Aviation and Toyota Motor complete demonstration flight in Shizuoka as companies prepare to bring…

2 hours ago

Nvidia Asked SK Hynix To Advance Next-Gen AI Memory Production

SK Hynix says Nvidia chief executive Jensen Huang asked if production of next-gen HBM4 memory…

3 hours ago