Microsoft has confirmed reports of vulnerability in Word that allows an attacker to exploit a system via the Microsoft Jet Database Engine

MS Word subjected to selective attacks.

Microsoft confirms Word attacks

Microsoft has confirmed reports of vulnerability in Word that allows an attacker to exploit a system via the Microsoft Jet Database Engine, which shares data with Access, Visual Basic and third party applications.

Microsoft in its advisory said the potential for attack is “very limited.” Reports of the Word flaw were highlighted by Panda and Symantec in the last two weeks. On March 3, Panda researcher Ismael Briones stumbled on the new exploit. On Thursday, Symantec also noted the Jet vulnerability. According to Symantec.

The attacker needs only to find a trick to force the MS Jet library to open the file and trigger the vulnerability that will run the malicious shellcode. Some social engineering and a little help from Office applications will work out well in this specific attack. In fact, it is possible to call MSJET40.DLL directly from MS Word, without using Access at all.

Microsoft said in its advisory:

Customers running Windows Server 2003 Service Pack 2, Windows Vista, and Windows Vista Service Pack 1 are not vulnerable to the buffer overrun being attacked, as they include a version of the Microsoft Jet Database Engine that is not vulnerable to this issue.

Customers using Microsoft Word 2000 Service Pack 3, Microsoft Word 2002 Service Pack 3, Microsoft Word 2003 Service Pack 2, Microsoft Word 2003 Service Pack 3, Microsoft Word 2007, and Microsoft Word 2007 Service Pack 1 on Microsoft Windows 2000, Windows XP, or Windows Server 2003 Service Pack 1 are vulnerable to these attacks.

Microsoft is investigating the public reports and customer impact. We are also investigating whether the vulnerability can be exploited through additional applications. Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This may include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs.

Microsoft then reiterated that the risk is limited since a customer would have to take multiple steps to make an attack successful.

more....
Microsoft Warns of New Attack on Word
Microsoft issues warning over Word attacks.
Microsoft has issued an alert this weekend, centering on targeted attacks using vulnerabilities in the MJDE (Microsoft Jet Database Engine) that can be exploited via Microsoft Word.

The Microsoft Jet Database Engine provides data access to applications such as Microsoft Access, Microsoft Visual Basic, and many third party applications. Jet can also be used by Internet Information Services (IIS) applications that require database functionality. The reported vulnerability is a code execution vulnerability caused by a buffer overrun in msjet40.dll, the Microsoft Jet Database Engine. An attacker can exploit this vulnerability by convincing a user to open a Word file that is constructed to load the specially crafted database file using msjet40.dll.

“This advisory contains information about a very limited, targeted attack exploiting a vulnerability in Microsoft Jet Database Engine,” Bill Sisk said on the MSRC blog. He reported that the initial investigation shows that this vulnerability affects Microsoft Word 2000, Word 2002, Word 2003, Word 2003, Word 2007, and on Microsoft Windows 2000, Windows XP, or Windows Server 2003 Service Pack 1.

“Customers running Windows Server 2003 Service Pack 2, Windows Vista, and Windows Vista Service Pack 1 are not vulnerable to the buffer overrun being attacked, as they include a version of the Microsoft Jet Database Engine that is not vulnerable to this issue,” Sisk adds.

According to the warning, the attack is targeted and not widespread. In either case, the SSRIP, Software Security Incident Response Process, was tasked to follow the attacks and issue an out-of-cycle patch or add it to the regular patch cycle.

Microsoft has issued the following workarounds in the meantime.

Microsoft has issued an alert this weekend, centering on targeted attacks using vulnerabilities in the MJDE (Microsoft Jet Database Engine) that can be exploited via Microsoft Word.


The Microsoft Jet Database Engine provides data access to applications such as Microsoft Access, Microsoft Visual Basic, and many third party applications. Jet can also be used by Internet Information Services (IIS) applications that require database functionality. The reported vulnerability is a code execution vulnerability caused by a buffer overrun in msjet40.dll, the Microsoft Jet Database Engine. An attacker can exploit this vulnerability by convincing a user to open a Word file that is constructed to load the specially crafted database file using msjet40.dll.

“This advisory contains information about a very limited, targeted attack exploiting a vulnerability in Microsoft Jet Database Engine,” Bill Sisk said on the MSRC blog. He reported that the initial investigation shows that this vulnerability affects Microsoft Word 2000, Word 2002, Word 2003, Word 2003, Word 2007, and on Microsoft Windows 2000, Windows XP, or Windows Server 2003 Service Pack 1.

“Customers running Windows Server 2003 Service Pack 2, Windows Vista, and Windows Vista Service Pack 1 are not vulnerable to the buffer overrun being attacked, as they include a version of the Microsoft Jet Database Engine that is not vulnerable to this issue,” Sisk adds.

According to the warning, the attack is targeted and not widespread. In either case, the SSRIP, Software Security Incident Response Process, was tasked to follow the attacks and issue an out-of-cycle patch or add it to the regular patch cycle.

Microsoft has issued the following workarounds in the meantime.
Microsoft has issued an alert this weekend, centering on targeted attacks using vulnerabilities in the MJDE (Microsoft Jet Database Engine) that can be exploited via Microsoft Word.


The Microsoft Jet Database Engine provides data access to applications such as Microsoft Access, Microsoft Visual Basic, and many third party applications. Jet can also be used by Internet Information Services (IIS) applications that require database functionality. The reported vulnerability is a code execution vulnerability caused by a buffer overrun in msjet40.dll, the Microsoft Jet Database Engine. An attacker can exploit this vulnerability by convincing a user to open a Word file that is constructed to load the specially crafted database file using msjet40.dll.

“This advisory contains information about a very limited, targeted attack exploiting a vulnerability in Microsoft Jet Database Engine,” Bill Sisk said on the MSRC blog. He reported that the initial investigation shows that this vulnerability affects Microsoft Word 2000, Word 2002, Word 2003, Word 2003, Word 2007, and on Microsoft Windows 2000, Windows XP, or Windows Server 2003 Service Pack 1.

“Customers running Windows Server 2003 Service Pack 2, Windows Vista, and Windows Vista Service Pack 1 are not vulnerable to the buffer overrun being attacked, as they include a version of the Microsoft Jet Database Engine that is not vulnerable to this issue,” Sisk adds.

According to the warning, the attack is targeted and not widespread. In either case, the SSRIP, Software Security Incident Response Process, was tasked to follow the attacks and issue an out-of-cycle patch or add it to the regular patch cycle.

Microsoft has issued the following workarounds in the meantime.