“Microsoft has warned of a serious – and as yet unpatched vulnerability – in Word. Hackers (albeit to a limited extent) are exploiting the zero-day flaw in its ubiquitous Office application, Redmond warns,” John Leyden reports for The Register.
Leyden reports, “The flaw – which stems from an unspecified memory corruption bug – doesn’t just affect Windows users. Microsoft Word 2000, Microsoft Word 2002, Microsoft Office Word 2003, Microsoft Word Viewer 2003, Microsoft Word 2004 for Mac, and Microsoft Word 2004 v. X for Mac, along with Microsoft Works 2004, 2005, and 2006 are all potentially vulnerable. Users tricked into opening maliciously constructed Word files are liable to find their systems compromised.”
More info and links here.
[Thanks to MacDailyNews Reader “Chas” for the heads up.]
MacDailyNews Note: Microsoft’s Security Advisory (929433 – almost time to add another digit there, M’Soft) states: “In order for this attack to be carried out, a user must first open a malicious Word file attached to an e-mail or otherwise provided to them by an attacker. As a best practice, users should always exercise extreme caution when opening unsolicited attachments from both known and unknown sources. Do not open or save Word files that you receive from untrusted sources or that you receive unexpectedly from trusted sources.
Related MacDailyNews article:
Mac users should not buy Microsoft software (or hardware) – May 16, 2003
I’m continually amazed at the number of websites (non-profits, govt, etc..) that have Word files rather than PDF files when you seek to download documents. I’m always wondering about the safety of these Word files.
I’m glad I’m not “dogfooding” that shit!
Microsoft could not remain satisfied at having created the most insecure and bug-ridden computer platform. They decided to go for the gold and attempt to pass their buggy software on to us Mac users also. Strive for perfection, I always say!
If you can never reach true perfection, ruin it for those that have….
” width=”19″ height=”19″ alt=”smile” style=”border:0;” />
MDN word: science – Microsoft has mastered the science of screwing up.
Article notes:
“Users tricked into opening maliciously constructed Word files are liable to find their systems compromised.”
What sort of compromise? What happens to the Mac? How does it happen?
Specific, detailed info from article authors and Microsoft would be much more helpful than this simple “boogeyman under the bed” warning.
Niffy
Is this a drive to promote MS security software for Mac’s as well as PC’s ?
‘we know Mac’s are vunerable – because we did it !!’
The only malware I’ve seen in my life was a harmless-to-Mac Microsoft Word 97 macro in a Word document sent to me by someone using Windows 98 in 2003-4. ClamXav took care of that. The only data I’ve ever lost in a crash was when Internet Explorer crashed on OS 8.6? If not for Microsoft innovation, my computers would have had a pristine record.
MW: “years” as in nothing’s changed in Redmond.
“I’m continually amazed at the number of websites (non-profits, govt, etc..) that have Word files rather than PDF files when you seek to download documents.”
Me too. MS-Word .DOC is not an exchange format. PDF is an exchange format.
MS-Word is not a document exchange format.
Don’t send me word documents.
PDF specification.
I have a rule that I implement for my PowerBook:
DO NOT USE MICROSOFT SOFTWARE!
Simple. And it works. Why waste 400MB+ on a word processor, spreadsheet and crap presenter? If you have to have Word compatability, use NeoOffice.
MacDailyNews Note: …As a best practice, users should always exercise extreme caution when opening unsolicited attachments from both known and unknown sources. Do not open or save Word files that you receive from untrusted sources or that you receive unexpectedly from trusted sources.
Yeah, that’s wonderful in theory. Those of us that receive upwards of 100 emails a day, spam excluded, from customers or people looking to submit press releases have to deal with reality though.
I’m too extremely curious about what this thing actually does…
Seems strange that a “memory corruption bug” can hit 2 VERY different platforms and do exactly the same thing?..
Pardon the lingo noob here….what exactly is “dogfooding?”
Keep in mind that not all companies have the ability to put documents into PDF format. I deal with many telecommunications companies with my job and most don’t have the ability to send things in PDF format. The number one telecom company, for example, sends everything as a word document because they don’t have PDFing abilities within their computer systems. While PDF is mainstream it still doesn’t have the penetration that a word document does. I wish it wasn’t that way but that is simply how the business world works.
I have an idea. Next time someone emails you a Word doc file, send them this link:
http://secunia.com/advisories/23232/
and then tell them to never send you another Word doc again.
“DOGFOODING”
see explanation on article about MS XML on Mac
This is a word processor…Unless MS designed some hidden backdoor in Word that permits executables (apart from macros). They should be taken to task for this. This is a big deal. And their solution is what…TO STOP DOING BUSINESS????!!!!
So i assume it’s safe to open Word documents in other compatible word processors such as Text Edit, Neo Office, Open Office, Pages, etc.
I’m still waiting for companies to start imposing policies where they refuse to use Microsoft Office documents due to the high risk of infection, kind of like how retail stores refuse to accept $50 and $100 bills due to high risk of counterfeits.
For some reason, common sense never seems to surface when Microsoft is involved.
My girlfriend phoned me to say that both her Windows machines blue screened this morning. STOP 0x0000007B: Inaccessible Boot Device. The screen says to run your virus software yet there is no way to run the thing…not even in safe mode. She has all the latest virus stuff provided by a service. As a Mac user since 1993 I cannot fathom this. This is all so normal for a Windows user, just part of the computing experience. FARG!
MW: “nuclear” as in meltdown
Jim,
Unfortuneately the business world relies on M$ Office products. I have tried Neo but can not stand it. Buggy and very slow.
One thing to note here is that while Apple recently released several patches for potential vulnerabilities, this one is in response to actual attacks. To quote from MS own security advisory,
“Microsoft Security Advisory (929433)
Vulnerability in Microsoft Word Could Allow Remote Code Execution
Published: December 5, 2006
Top of section
Microsoft is investigating a new report of limited “zero-day” attacks using a vulnerability in Microsoft Word 2000, Microsoft Word 2002, Microsoft Office Word 2003, Microsoft Word Viewer 2003, Microsoft Word 2004 for Mac, and Microsoft Word 2004 v. X for Mac, as well as Microsoft Works 2004, 2005, and 2006.”
Big difference. Not to mention the fact that this one just requires that you look at a word doc.
@war
I contend that the telecommunications companies you work with are lazy and/or have a myopic view of IT. It would appear that their computing software infrastructure and expertise starts and stops at Microsoft.
The link I posted to the Adobe site clearly explains how PDF works for developers who are interested…
“The PDF specification was first published when Adobe® Acrobat® was introduced in 1993… …The PDF Reference provides a description of the Portable Document Format and is intended for application developers wishing to develop applications that create PDF files directly, as well as read or modify PDF document content.”
Apple makes extensive use of PDF as a display and print technology in OS X. I can go hog wild with PDF on my Linux machines.
Interoperability is a very long word. Can you spell IT?
STILL NO ONE HERE HAS RESPONDED TO THE QUESTION : WHAT HAPPENS TO THE MAC WITH THIS OFFICE ISSUE?
Inform please!!! Even the linked article was useless.
I’m assuming the answer is “nothing” but I’d like confirmation.
Maybe you guys should start looking at the fires in your own houses, too. Where’s the mention of the numerous patches for apps running on OSX because of vulnerabilities found? What’s that? I can’t hear you. Thought so. Now shut the hell up.
Niff and MacRaven are right.
Exactly what happens on a Mac if a Word file that uses this exploit is opened? Does the Mac crash? How is the Mac compromised? I find it hard to believe that a Word exploit that would open up hacker access in Windows would do the same thing on a Mac.
These are important questions, and we need to get the answers asap.
Bill Gates said in 1993:
With advancing technology, in the next three years spam will be a thing of the past.
NY Times today:
Quoting the above – there is now double the spam as in 2003.
Zune Tang’s conclusion:
Bill must have this new technology only in Vista.
My conclusion:
Add this to the 640K estimation as enough RAM to MS’s level of prophecy. Now I am glad that the UniBinary Office 2007 will not have VB macro capabilities, only AppleScript.
What if you use Pages to open your word files? Are you only vulnerable if you use Word to open them?
Hmmm something smells fishy here… is VB required or not?
re: stormy. Yeh, it’s a bummer that the business world relies on M$, but I still make a helluva lotta money NOT using their crap products.
There’s always a way to avoid using M$, I kinda enjoy rising to the challenge and bypassing Micro$haft products, and still getting the job done.
Word, in one Word, is shit. I’d rather use a typewriter.
“Word, in one Word, is shit. I’d rather use a typewriter.”spoken like a true mac troglodyte. bite off your own nose to spite your face.
The only reason why people still use Office is because their managers (and higher ups) don’t know any better, and IT tells them it is necessary. If the managers knew that they could install another mail server product and run Open Office on their user machines, and get the same results, they would shit their pants. After all, they just care about the bottom line anyway.
And NeoOffice for OS X was the best thing to happen to Open Office. No X11 or XDarwin required.
Word is not shit.
Word 3 was an amazingly useful, versatile word processor.
It’s gone downhill ever since, though…
“STILL NO ONE HERE HAS RESPONDED TO THE QUESTION : WHAT HAPPENS TO THE MAC WITH THIS OFFICE ISSUE?”
It will cause your Mac to
” width=”19″ height=”19″ alt=”grin” style=”border:0;” />
Seriously, this is one of those cases where obscurity will probably help. First, Mac Office runs in Rosetta/PowerPC. So any exploit will also have to be written using the PowerPC ISA. As always, the obscurity of PowerPC will probably help protect Mac users. Since you can’t really do a “cross-platform” virus in this case, malicious folks will probably do an Intel version for Windows and be done with it.
So I wouldn’t panic too much about Word documents in Mac Word. The worst that would happen is that it will try to execute Intel instructions and crash.
From 1991 to 1998 I declared a private war on Microsoft and refused to have anything from Microsoft on my Hard drive or in my computer. I did quite well with WordPerfect and other replacements.
Then I resigned and joined the club and used MS Explorer and Office.
Well, me thinks it is time to purge my HD of all things Microsoft once again!
hey, mr. don’t pass the koolaid – what’s your deal? word is shitty, it doesn’t do what i need it to do and it tries to do things that i want it to stop. i don’t use i, i don’t have to and i don’t understand what that has to do with drinking jobs’ koolaid. and, incidentally, you get that this is a mac site, right? yeah, we probably like these products more than others. get a clue.
And now here’s something completely different…
Get a MAC animated – Google Video
See? Cute and no obscenities. Fun for all ages.
To “Don’t pass the koolaid” who posted:
“Maybe you guys should start looking at the fires in your own houses, too. Where’s the mention of the numerous patches for apps running on OSX because of vulnerabilities found?”
Difference is Apple patches BEFORE anyone in the wild get’s hurt.
Micro$oft patches AFTER half the world’s computer’s have crashed and burned.
Who cares about counting PATCHES you dufus…. give me a count of the actual number of compromised Apple systems in the wild?
Apply the rest of your post to yourself please: “What’s that? I can’t hear you. Thought so. Now shut the hell up.”
What about targeted attacks from ‘trusted’ sources, such as your colleagues in the office? Suppose one of them wants to own you, your email, your passwords, awww what the hell – why not your entire Powerbook. Stop using Micrososft. The sooner the better.
Let them fuck themselves.
to Don’t pass the koolaid
go back to your porn
In a battle of wits, you’re unarmed.
Re: What Happens to the Mac with this Office (sic) Issue?
If you read carefully, Microsoft is the source of this warning and they are saying that there is a potential for pwnage of a system (they aren’t specific about which kind of system) by opening a specially crafted Word file. They also hint that this method may already be in play, but again, no specifics on how the “system” was affected. Everyone else is just repeating the Microsoft warning.
So is your Mac in danger? Only Microsoft really knows.
Is this a bit of FUD mixed in with the usual Windows security issues? Again, only Microsoft knows for sure.
The only safe course of action is to avoid Word files, at least until this is patched.
What a bunch of crap — have not seen ANY specific details as to HOW this Word malware affect the Mac — ONLY some *boogeyman-under-the-bed* sort of warning — *booga**booga**BOO*!!
And, SOMEHOW, this is partially the fault of the Mac OSX system, according to some of the Windblows fanboyz who can’t spell HTML without a cheat-sheet?
Niffy