Critical Word 0-day is only 1 out of 3 Microsoft bugs under attack

A zero-day code-execution vulnerability in Microsoft Office is one of three critical flaws under active attack in the wild, Microsoft warned Tuesday as it rolled out a batch of updates that plug the security holes.

As reported earlier, attackers are exploiting the flaw to infect unsuspecting Word users with bank-fraud malware known as Dridex. Blog posts published Tuesday morning by security firms Netskope and FireEye reported that attackers are exploiting the same bug to install malware with the names Godzilla and Latenbot.

Ryan Hanson, a researcher at security firm Optiv and the person Microsoft credited with reporting the critical bug, said exploits can execute malicious code even when a mitigation known as Protected View isn’t disabled. The attacks are able to bypass other exploit mitigations as well. Microsoft’s fix for CVE-2017-0199, as the flaw is indexed, is here.

According to Microsoft, flaws in two other products are also being exploited in the wild. One is an Internet Explorer vulnerability that allows attackers to access sensitive information from one domain and inject it into another address. Such elevation-of-privilege vulnerabilities are typically exploited along with an additional attack exploiting a separate bug so the attack chain can bypass a security sandbox or similar security protections. Microsoft’s guidance for CVE-2017-0210 said the IE bug is being exploited, but it didn’t elaborate.

The third zero-day also resides in Office 2016, 2013, and 2010 and isn’t actually being patched in Tuesday’s update batch. According to guidance for the flaw: “Microsoft is aware of limited targeted attacks that could leverage an unpatched vulnerability in the [Encapsulated PostScript] filter and is taking this action to help reduce customer risk until the security update is released.” The flaw is exploited when a target opens a malicious EPS image in Word.

In all, Microsoft released 15 updates on Tuesday patching dozens of individual flaws in software, including the Windows operating system, Exchange Server, and Adobe Flash. It’s always a good idea to install updates as soon as possible. The active attacks on three separate Microsoft products makes that advice particularly important this month.

Sharing is caring!