News

New Word, Windows Vulnerabilities Surface

• By Stephen Swoyer
• April 13, 2007

Elsewhere, security mailing lists were abuzz with talk of another new Windows vulnerability: a flaw in Microsoft's Windows Help implementation.

The new Word flaws affect only the Office 2007-flavored version of that product. That wasn't the case in February, when Microsoft released a roll-up fix to patch a quartet of vulnerabilities in its Word 2000, Word 2002 (XP), Word 2003 and Word for Macintosh. Several of the vulnerabilities were linked to known zero day attacks. Ironically, Word 2007 was invulnerable to those attacks.

The new flaws, which were disclosed on the Bugtraq mailing list, could make Word 2007 susceptible to Remote Code Execution and denial-of-service (DoS) exploits, according to their discoverer, Israeli security researcher Mati Aharoni. The more serious of the two -- a buffer overflow in Word 2007's WWLIB.DLL -- can allow both DoS and remote code execution attacks, Aharoni claimed.

He also disclosed the possibility of "multiple unspecified vulnerabilities" in Word 2007 that attackers could exploit to cause DoS. Aharoni has developed proof-of-concept code in the form of malicious documents.

Neither issue has yet been confirmed by Microsoft; their status at the Common Vulnerabilities and Exposures (CVE) repository is currently listed as "Under Review."

Little is known about the impact of the Windows Help flaw, which affects files with the .HLP extension. An attacker can exploit it by crafting a malicious .HLP file which -- when executed -- triggers a heap-based buffer overflow. The complete ramifications of doing so are, at present, unknown. A similar issue was identified last year; that vulnerability was linked to a remote code execution exploit.

The most recent Windows Help vulnerability, like the Word 2007 flaws, was identified by Aharoni.