MUST READ: Is this the first glimpse of the Google Nexus 8?

Topic: Security

Discover

Zero-Day attacks hit Windows, Office, Lync

Summary: Certain versions of Windows, Office and Microsoft Lync are being attacked in the wild via a new remote code execution vulnerability, says Microsoft in a disclosure.

Larry Seltzer

By for Zero Day |

Microsoft today disclosed a vulnerability in the graphics code in certain versions of Windows, Office and Lync. They say they have received reports of targeted attacks in the wild using the vulnerability, specifically against Microsoft Office.

The disclosure includes instructions for various workarounds that users may employ to mitigate against attacks. The workarounds include a "Fix It" link to automate the workarounds.

The affected products are:

  • Windows Vista x86, x64
  • Windows Server 2008 x86, x64, Itanium, Server Core
  • Microsoft Office 2003
  • Microsoft Office 2007
  • Microsoft Office 2010 x86, x64 
  • Microsoft Office Compatibility Pack 
  • Microsoft Lync 2010 x86, x64
  • Microsoft Lync 2010 Attendee
  • Microsoft Lync 2013 x86, x64
  • Microsoft Lync Basic 2013 x86, x64

Of these products, only Lync 2013 is a current version. Windows 7 and 8 and Office 2013 and Office 365 are not affected.

Like almost all such vulnerabilities, this one would only allow remote code execution in the context of the affected user, but such attacks can often be combined with a privilege escalation vulnerability exploit to give administrator privileges to the attacker.

The vulnerability, which was reported to Microsoft by Haifei Li of McAfee Labs IPS Team, is due to a bug in the software's handling of specially-crafted TIFF files. The bug results in memory corruption which may be exploited by the attacker to take control of execution.

The workarounds described by Microsoft involve disabling the TIFF codec and using the Enhanced Mitigation Experience Toolkit (EMET) to block execution in the application. EMET can also be deployed through Group Policy.

Topics: Security, Microsoft

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

23 comments
Log in or register to join the discussion

  • make the EMET a standard feature via Windows Update

    Then just push whatever mitigation is necessary at the time.
    greywolf7
    Reply 6 Votes

    • Not ready for that

      "At this time, EMET is only available in the English language. For more information, see Microsoft Knowledge Base Article 2458544."
      larry@...
      Reply Vote

    • Yes - very surprised MS hasn't done so on their own

      I don't know why EMET is opt-in, instead of opt-out for the apps that don't support it. Windows is quite backward in this regard, as compared to most Linux and BSD distros.
      daboochmeister
      Reply Vote

      • EMET, via a GUI, provides hardening beyond the default DEP/ASLR in Windows

        Similar to what PaX does for GNU/Linux:

        http://en.wikipedia.org/wiki/PaX

        How many GNU/Linux distros ship with PaX (which is currently included in grsecurity)? None that I am aware of.

        And grsecurity generally requires one to download the Linux kernel source, the grsecurity patch and apply the grsecurity patch to the kernel. Which means compiling the Linux kernel. Hi, Mr. Davidson [waves].
        Rabid Howler Monkey
        Reply 1 Vote

  • microsoft product at risk.... what about office 2000?

    microsoft product at risk.... what about office 2000?
    couryhouse@...
    Reply 23 Votes

    • It probably is as well

      but they're not supporting Office 2000 at this point.
      Michael Alan Goff
      Reply 1 Vote

    • It's no longer supported, so...

      ...it's not even mentioned. 5 editions and 14 years after Office 2000 was first released, they probably didn't even test it for the vulnerability.
      goyta
      Reply 2 Votes

    • 2000

      xD! should probably upgrade.
      Patrick Hopkins
      Reply 2 Votes

    • Microsoft products at risk..

      And this is news how exactly???
      The Central Scrutinizer
      Reply 27 Votes

  • Larry somthing is hosed with the capcha when I try to email you.

    Larry somthing is hosed with the capcha when I try to email you.
    couryhouse@...
    Reply 37 Votes

  • Does a TIFF file need self-modifying code?

    My thoughts turn to hardware-level capabilities that should be enabled to prevent memory that's not marked executable to get corrupted and result in execution control. While dynamic function pointers are stored in modifiable memory, corrupting them would just cause execution to start somewhere else in the code base which should just crash the app. If the function pointer points to an attack payload that was in the TIFF and loaded into non-executable RAM, the process should be halted. That leaves me thinking the TIFF graphics routines in these products must respond to the dynamics of the graphic by loading and executing extensions or perhaps by leveraging self-modifying code. Still, these should be completely dynamic extensions or self-modifications. How does a compromised TIFF convince the graphics routines to mark non-executable memory as executable before leveraging a corrupt function pointer to pass execution to a potential TIFF payload?
    robradina@...
    Reply Vote

    • Correction...

      ...these SHOULDN'T be completely dynamic extensions or self-modifications... (in other words they should be well-known -- not something where it's possible the TIFF file delivers executable code to the routine which then marks it executable and subsequently executes it)
      robradina@...
      Reply Vote

    • Return oriented programming - Trampoline code

      TIFFs do not contain function pointers. What you Refer to is DEP - which was put in place years ago. Then ASLR was needed because the attackers started using return oriented programming.
      honeymonster
      Reply Vote

  • So it begins

    Microsoft is releasing flaws, to select groups, on an effort to steer people to a less desirable OS. If windows 8 was so great, why do they need to release these scare monger flaws?
    I hate trolls also
    Reply 3 Votes

    • AnoIFther conspiracy theory?

      Your thought may be more valid IF Win 7 was also affected. Since it is not, this being a "scare tactic" to boost Win 8 sales seems unlikely. If I was going to use your argument, it would seem more likely this was to boost sales of Office 2013 or Office 365 which seem to be mostly unaffected with the exception of Lync.

      Whether you like Microsoft or not is beside the point. I have seen no evidence to date that would suggest Microsoft has EVER engaged in this type of practice simply to boost sales. If you have evidence, please provide verifiable details. Otherwise, please don't turn this discussion into an indictment of Microsoft!

      As all long time Microsoft software users know and have experienced, the Windows/Office/IE environments are frequent targets of hackers...not because of their inherent code flaws, but because of the number of systems these hacks can allow them to possibly access.

      It is relatively pointless to create hacks against either Mac or Linux based machines since the installed user base is incredibly small by comparison!
      number cruncher
      Reply Vote

  • Still more GOTCHA's from................

    Our Trusted computer product supplier Microsoft..................

    One has to wonder on their expertise in continually releasing code and applications that just keep on getting expoilited/comprised.

    I am not going to say more than Im looking at alternatives.
    carlsf@...
    Reply 3 Votes

    • It's an effort

      To heard people to the latest, but not greatest, version of Windows. Personally I would rather never use a computer again, before ever buying windows 8
      I hate trolls also
      Reply 1 Vote

    • Right

      Carlsf - if you're that hot a programmer - let's see you do better?

      For Starters:

      What operating system have you created and maintained?
      Which office suite?

      The best alternative is to just shut your computer off.
      inkwell
      Reply Vote

  • Zero-Day attacks hit Windows, Office, Lync

    Sounds like another desperate ploy to get everyone onto the Microsoft up grade mill.

    When everyone knows your desperate after taking a $900,000,000.00 write down, you do what ever you can to keep people moving towards newer products.

    Microsoft wants people off old products like XP,Vista,old office ,etc as fast as possible.

    If people were really smart they would move over to Apple and live a care free life.

    End Of Story
    Said Enough
    Reply 4 Votes

    • Not everyone drives a Maseratti, Said Enough..

      I'm happy your Wall Street investments allow you to follow Apple's latest hardware, and software.. but some of us are either retired or work for a living.
      robertcape@...
      Reply 1 Vote
CNET Join | Log In | Privacy | Cookies Close