NOW READ THIS
("Security Advisory")

Go Back

---

Submitted by: Bill Hickey
NCVA List Master

NRT-0125 Microsoft Contests New Office Flaw Reports:

Microsoft is disputing reports of three new flaws in its Office software while also taking issue in how the alleged flaws were disclosed. Several security web sites reported four new vulnerabilities, three affecting Word 2007, just as Microsoft released its latest round of security patches. Microsoft said in a statement that none of the three alleged to affect Word 2007 "demonstrate any vulnerability in Word 2007 or any Office 2007 products." The company also said it was not notified of the alleged problems before they were publicly disclosed; a practice generally frowned upon in the security industry. Two of the alleged Word 2007 problems are said to cause CPU usage to surge to 100%, creating a denial of service condition, according to a posting on the Security Vulnerabilities Web site. The third vulnerability, also concerning Word 2007, could supposedly allow remote code execution. The fourth alleged vulnerability, which concerns the ".hlp" extension for Windows help files, could lead to a heap overflow condition, the posting said. Microsoft acknowledged the problem, saying that .hlp is an "unsafe file format" and is executable, meaning that it will run code when opened.

(IDG News Service 11APR07)

Last Modified: Saturday, 14-Apr-2007 09:54:11 EDT