Zero-day flaw uncovered in Microsoft Works

By Dave Nixon

Chinese-language blogs are specifying a zero-day susceptibility in Microsoft Works, the company’s lower-end office productivity suite, according to security vendor McAfee.

The vulnerability is inside an ActiveX control for the Works’ Image Server, wrote McAfee analyst Kevin Beets. A PC would need to visit a website engineered to exploit the flaw, Beets wrote.

A zero-day flaw is a software vulnerability that has become public knowledge but for which no patch is available. It is predominantly dangerous given that users are exposed from day zero until the day a vendor prepares a patch and notifies users it is complete.

Proof-of-concept code was posted on a Chinese blog showing how the quandary could cause Windows to crash, Beets wrote. Then, a few hours later, a functioning exploit appeared, which could allow malevolent code to run on a machine.

ActiveX is Microsoft’s technology that allows website designers to attach extra functionality to Web pages or allows different applications to access the same software component, such as a spell-checker. But ActiveX controls have also been engaged by hackers in order to hoax people into downloading malicious code.

As with the majority of ActiveX controls, users will get a notice asking whether they want to download it or not, Beets wrote, but the vulnerability is “easily exploitable” once the control has been downloaded. McAfee tried it out using Windows XP Service Pack 2 and Internet Explorer 7.

One method to stop the progress of the attack is to block the particular ActiveX control, Beets wrote. Microsoft has instructions on its website for this procedure.

The company did not have an immediate comment as of Friday morning.