Microsoft Office zero-day allows hackers to install malware using Word

MICROSOFT OFFICE USERS are being warned of a new zero-day security flaw that has been exploited since at least January.

The  flaw enables attackers to covertly install malware on PCs by exploiting flaws in Microsoft's Object, Linking and Embedding (OLE) technology.

Security researchers at McAfee have been first off the mark among security vendors, publishing a blog over the weekend on the vulnerability.

The security group claims that it intercepted suspicious Microsoft Word Rich Text Format (RTF) format documents that, when opened, runs the exploit. This connects to a remote server in the background and downloads a file that contains an HTML application content file that looks like a Microsoft document, but executes it as a .hta file.

The .hta file enables the attacker to gain full administrator rights on the victim's machine.

"The successful exploit closes the 'bait' Word document, and pops up a fake one to show the victim. In the background, the malware has already been stealthily installed on the victim's system," McAfee warned.

It added that the root cause of the zero-day vulnerability is related to the Windows OLE feature in Windows, that Microsoft Office takes advantage of.

Security researchers at FireEye said that they also recently detected malicious Microsoft Office RTF documents that leverage a previously undisclosed vulnerability. They added that the vulnerability enables attackers to download and execute malware payloads from different well-known malware families.  

The security company said it had been in contact with Microsoft about the vulnerability for several weeks, but did not publicly disclose any details until McAfee decided to reveal all in its blog post.

Microsoft is likely to release a security update along with its next batch of updates, scheduled for this Tuesday.

In the meantime, McAfee warns users to not open Office files obtained from untrusted sources. It added that the attack cannot bypass the Office Protected View, so suggested that all users turn this feature on. µ

• Tweet  
• Facebook  
• Google plus  
•  
•  
• Send to  

• Topics
• Security
• Microsoft
• Windows
• Security
• SMB services
• SMB Spotlight