Microsoft warns of critical flaw in Office

By Matt Whipp

Posted on 4 Sep 2003 at 10:35

Microsoft has warned of a critical flaw in Microsoft Visual Basic for Applications affecting Office users and Visual Basic developers.

It's a familiar story. The problematic software in question doesn't properly check the properties of documents when they are opened, and thus a specially constructed document could exploit this, using an unchecked buffer to run code on the system.

To be successful, an attacker would have to somehow persuade their victim to open the malformed document and even then code run would only have the same privileges as the logged in user.

The flaw in Visual Basic for Applications exists in Office applications and the development kits for Visual Basic offered by Microsoft and also Microsoft's Business Solutions products. It was discovered by US security firm eEye Digital Security.

Microsoft has made a patch available at its Office Update site. The patch can't be uninstalled and requires a reboot.

Microsoft has also posted two warning of flaws it considers important. Firstly, a buffer overrun in WordPerfect Converter, and a flaw in Microsoft Word could enable macros to run automatically.