Microsoft Zero Day Exploits

Microsoft has released an advisory detailing how there are some attempts to use a vulnerability in Microsoft Word, specifically, Microsoft Office 2000 and Microsoft Office XP. There is no patch available, and they recommend not opening any attachments from un-trusted sources, but they do not that they have updated Windows Live Onecare to detect malware attempting to exploit this.

Microsoft is investigating new public reports of very limited, targeted attacks against Microsoft Word ?zero-day? using a vulnerability in Microsoft Office 2000 and Microsoft Office XP.

In order for this attack to be carried out, a user must first open a malicious Office file attached to an e-mail or otherwise provided to them by an attacker.

Customers in the U.S. and Canada who believe they are affected can receive technical support from Microsoft Product Support Services at 1-866-PCSAFETY. There is no charge for support calls that are associated with security updates. source: Microsoft Security Advisory (933052): Vulnerability in Microsoft Word Could Allow Remote Code Execution

Some common security practices to protect yourselves, even from a zero day like this, is to only run under a limited user account and not as an administrator. Go into control panel, make sure everyone who uses this pc has a user account, make sure each user account is limited, and set a good password on the administrator account that you can use to install needed software, and install software only. Also, make sure your firewall is on, if you use a router you should be okay behind it, as it is a hardware firewall, always make sure you have anti virus software and anti spyware software, here is a page full of free scans for your system, use them as many times as you like.

Don’t accept files from people you don’t know, if you get a suspicious file from someone you do trust, ask them what it is before opening, they could be infected and actually spreading malware, there are many cases of that happening, IM Worm Attack Cloaked in Virtual Card Hoax, Spim, Splog and Spam On the Rise and here is a list of the Latest IM and P2P Threats for your perusal. Oh, and I know some people won’t like this, but, always, allow Windows to download the latest patches, you don’t have to let them do it by itself, but at least download and look through the list.