
Microsoft Office zero-day allows hackers to install malware using Word
McAfee sounds the alarm bells over unpatched vulnerability

MICROSOFT OFFICE USERS are being warned of a new zero-day security flaw that has been exploited since at least January.
The flaw enables attackers to covertly install malware on PCs by exploiting flaws in Microsoft's Object, Linking and Embedding (OLE) technology.
Security researchers at McAfee have been first off the mark among security vendors, publishing a blog over the weekend on the vulnerability.
The security group claims that it intercepted suspicious Microsoft Word Rich Text Format (RTF) format documents that, when opened, runs the exploit. This connects to a remote server in the background and downloads a file that contains an HTML application content file that looks like a Microsoft document, but executes it as a .hta file.
The .hta file enables the attacker to gain full administrator rights on the victim's machine.
"The successful exploit closes the 'bait' Word document, and pops up a fake one to show the victim. In the background, the malware has already been stealthily installed on the victim's system," McAfee warned.
It added that the root cause of the zero-day vulnerability is related to the Windows OLE feature in Windows, that Microsoft Office takes advantage of.
Security researchers at FireEye said that they also recently detected malicious Microsoft Office RTF documents that leverage a previously undisclosed vulnerability. They added that the vulnerability enables attackers to download and execute malware payloads from different well-known malware families.
The security company said it had been in contact with Microsoft about the vulnerability for several weeks, but did not publicly disclose any details until McAfee decided to reveal all in its blog post.
Microsoft is likely to release a security update along with its next batch of updates, scheduled for this Tuesday.
In the meantime, McAfee warns users to not open Office files obtained from untrusted sources. It added that the attack cannot bypass the Office Protected View, so suggested that all users turn this feature on. µ
INQ Latest
EU aims to crush anti-competitive online behaviour with new law proposals
Oh look, the EU is getting stuck into the workings of tech again
GPU crypto-mining slump could see prices drop by 25 per cent
At last, the break gamers have been waiting for
Telegram downloads in Russia have reportedly increased following ban
Users have flocked to VPN services to skirt the block, claims NordVPN
Facebook brushes off Cambridge Analytica scandal with record Q1 revenues
'Stick that in your #DeleteFacebook', smirks social network