11 April 2007, 15:05

New zero-day exploits not only for Microsoft Office

A hacker named Mati Aharoni has published various demos in security forums to prove that security problems exist in Microsoft Word 2007. He claims these were detected with a small Python fuzzer. In a blog entry, McAfee Avert Labs have confirmed that the demos will be investigated and that there is at least one heap overflow flaw, which might be exploited for code execution. In the course of the last few months, several such bugs in Office products have been exploited for targeted attacks on certain companies and institutions.

According to McAfee, the other Word demos only crash the system or cause a high system load. However, the experts at Avert Labs also confirm another, possibly critical Windows flaw, also demonstrated by Aharoni, which is related to the HLP files and which might also cause a buffer overflow on the heap.

At the moment it is not clear whether these are demos of new holes or they exploit known Word vulnerabilities, such as the one already published by eEye .