Chinese blogs detail zero-day flaw in Microsoft Works

by Jeremy Kirk

April 18, 2008 —

Chinese-language blogs are detailing a zero-day vulnerability in Microsoft
Works, the company's lower-end office productivity suite, according to security
vendor McAfee.

The vulnerability is within an ActiveX control for the Works' Image Server,
wrote
McAfee analyst Kevin Beets. A PC would need to visit a Web site engineered
to exploit the flaw, Beets wrote.

A zero-day flaw is a software vulnerability that has become public knowledge
but for which no patch is available. It is particularly dangerous since users
are exposed from day zero until the day a vendor prepares a patch and notifies
users it is ready.

Proof-of-concept code was posted on a Chinese blog showing how the problem
could cause Windows to crash, Beets wrote. Then, a few hours later, a working
exploit appeared, which could allow malicious code to run on a machine.

ActiveX is Microsoft's technology that lets Web site designers add extra functionality
to Web pages or allows different applications to access the same software component,
such as a spell-checker. But ActiveX controls have also been employed by hackers
in order to trick people into downloading malicious code.

As with most ActiveX controls, users will get a warning asking whether they
want to download it or not, Beets wrote, but the vulnerability is "easily
exploitable" once the control has been downloaded. McAfee tried it out
using Windows XP Service Pack 2 and Internet Explorer 7.

One way to halt the attack is to block the particular ActiveX control, Beets
wrote. Microsoft has instructions on its Web site for
this procedure.

The company did not have an immediate comment as of Friday morning.

IDG News Service