Zero-Day Microsoft Word Attack Now Underway

As if Windows users didn't have enough to worry about, hackers have exploited a newly discovered vulnerability in Microsoft Office Word 2003, and the exploit will soon be distributed widely online, say security researchers. The attack, dubbed Trojan.Mdropper.H, is a Trojan horse that exploits an undocumented vulnerability in Word and drops a file on compromised computers, according to security firm Symantec.

"Currently, observed attacks are limited to attacks against select targets," Symantec warned in a security bulletin. The Trojan horse begins as a Word document email attachment that includes an embedded executable; when the attachment is opened, a backdoor application is installed and the system is compromised. The back door, hidden with a rootkit, opens a communications channel to a malicious Web site, from which the program awaits instructions. The Trojan horse performs numerous functions, including taking and transmitting desktop screenshots, by which financial data or passwords might be stolen.

Trojan.Mdropper.H affects Word 2003 only, but can crash Word XP and Word 2000 without compromising the system. Affected OS versions include Windows Server 2003 and earlier. Microsoft says it's working on a fix for release on or before June 13, the next regularly scheduled security update release date. In the meantime, Symantec recommends blocking Word attachments at the network perimeter.