It's reported that, as of 11 April, patches are available for a security bug in Microsoft Office and in Wordpad which was disclosed to the company in October. The flaw was widely exploited after McAfee blogged about it. It affects Microsoft Office 2007 SP3 and Windows Vista SP2; the latter was released in May 2009 and the former in October 2011.
In related news, The Register (nonCloud-flare link) says that
[...] CVE-2017-0210 in Internet Explorer, and CVE-2017-2605 in Office – are being actively attacked in the wild by miscreants and the Dridex malware. That latter bug has no patch, by the way: Microsoft just switched off an exploited PostScript filter by default.
further information: CVE-2017-0199
coverage:
related story:
After Microsoft Delays Patch Tuesday, Google Discloses Windows Bug
Related Stories
For the second time in three months, Google engineers have disclosed a bug in the Windows OS without Microsoft having released a fix before Google's announcement. The bug in question affects the Windows GDI (Graphics Device Interface) (gdi32.dll), which is a library that enables applications to use graphics and formatted text on both the video display and a local printer.
According to a bug report filed by Google's Project Zero team, the bug was initially part of a larger collection of issues discovered in March 2016, and fixed in June 2016, via Microsoft's security bulletin MS16-074. Mateusz Jurczyk, the Google engineer who found the first bugs, says the MS16-074 patches were insufficient, and some of the issues he reported continued to remain vulnerable. Following subsequent tests, the researcher resubmitted his bug report in November, which Microsoft failed to patch in the 90 days interval Google allows vendors to fix bugs before going public with its reports.
This is the second time Google has taken this step against Microsoft after in November 2016 it disclosed details about a zero-day exploited by a cyber-espionage group known as APT28 (Strontium) a few days before Microsoft's November Patch Tuesday. Back then, Google said it took this step to allow users to protect themselves until Microsoft published a patch. Microsoft's Terry Myerson, Executive Vice President, Windows and Devices Group, didn't see it the same way, describing Google's actions as "disappointing" because it put customers at greater risk of exploitation.
(Score: 0) by Anonymous Coward on Sunday April 30 2017, @02:31AM
MS products are security "bugs".
(Score: 4, Informative) by butthurt on Sunday April 30 2017, @02:52AM
McAfee say they saw the bug being used in "late January."
https://securingtomorrow.mcafee.com/mcafee-labs/critical-office-zero-day-attacks-detected-wild/ [mcafee.com]
Metasploit has a module.
https://github.com/rapid7/metasploit-framework/issues/8220 [github.com]
https://github.com/rapid7/metasploit-framework/pull/8254/files/3d082814cbedc065f329498b9c6fb7951f8ebbd5 [github.com]
(Score: 0) by Anonymous Coward on Sunday April 30 2017, @03:42AM
The way to avoid getting malware is not to hang around with idiots who always have all the latest malware.
Sure I never talk to anyone and I suck my own dick but it's worth it not to see malware ever.