New MS-Word macro warning

[InfoSec News <isn () c4i org>]

http://www.theregister.co.uk/content/6/19111.html

By: Thomas C Greene in Washington
Posted: 22/05/2001 at 05:30 GMT

While it's true that all recent versions of MS Office supposedly
require the user's permission to run a macro, a wee little oversight
at Redmond Security Central makes it possible for an RTF (Rich Text
Format) document opened by Word to execute a macro automatically if
it's embedded in a template.

"When Word is used to open a document thats based on a template, both
the document and the template should be checked for macros. This
vulnerability involves a case in which this isnt done correctly," an
MS security bulletin explains, doing its damnedest not to say 'we
goofed'.

Macros run on a machine or network at the user's level of permission,
so of course a malicious one can perform quite a lot of mischief.

In this case, developing an exploit would be child's play. The
required template could be fetched from a remote location, such as a
Web site to which the feature-rich Word can connect automatically.
This would be the preferred MO for someone trying to propagate via
e-mail a macro virus exploiting the RTF vulnerability.

RTF is something of the lingua franca of word processing, readable by
just about every application ever designed, so it's still in common
use wherever people have to collaborate whilst using different
software.

Affected programs include Word 97; Word 98 (J); Word 2000; Word 98
(Mac); and Word 2001 (Mac), but not Word 2002.

"Previous versions [of Word] are no longer supported and may or may
not be affected by this vulnerability," MS says. It's reasonable to
assume that they are affected, so there we have one more little motive
to upgrade.



ISN is hosted by SecurityFocus.com
---
To unsubscribe email isn-unsubscribe () SecurityFocus com.