Another Microsoft bug revealed on huge patch day
 Along with its biggest patch release in five years, Microsoft warned on Tuesday of another potentially dangerous vulnerability in its software.
The problem lies within the WordPad Text Converter for Word 97 files, Microsoft said in an advisory.
The systems affected include Windows 2000 Service Pack 4, Windows XP Service Pack 2, Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2, Microsoft said. XP Service Pack 3 and the Vista operating systems are not affected.
The company said it has seen limited, targeted attacks. If exploited, a hacker could gain the same rights on a PC as a local user and could remotely execute code.
Microsoft is investigating the problem. Microsoft typically releases patches on the second Tuesday of the month. If Microsoft sticks to its schedule, the earliest a patch could be released would be Jan. 13. However, Microsoft has deviated from its patching cycle when a vulnerability is considered particularly dangerous.
The vulnerability can't be exploited by simply opening an e-mail, Microsoft said. The victim would have to open an attachment containing a malicious file designed to exploit the problem.
Microsoft said Word 97 documents are opened by default with Office Word if a user has that application installed. Word is not affected by the problem, but attackers could try to rename the malicious file with a Windows Write (.wri) extension, which would be cause WordPad to try to open it. The company advised that ".wri" attachments could be blocked at the network gateway, reducing the risk a user would open a harmful file.
Microsoft released on Tuesday eight patches covering 28 vulnerabilities within applications including Internet Explorer, Sharepoint, Office, Windows Media Player and its Vista OS. Six of those patches were classified as "critical."
IDG News Service
Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world
On Twitter now
microsoft
Powered by Twitter
jfruh
Apple syncing patent can't come soon enough
pasmith
New Twitter features borrow from 3rd party clients
Esther Schindler
Open Source Changes the Software Acquisition Process
mikelgan
How to set up continuous podcast play on the new iTunes
David Strom
Five important Windows 7 mobility features
sjvn
Guard your Wi-Fi for your own sake
Sandra Henry-Stocker
Grepping on Whole Words
Sidekick: The Good News & the Bad News
Either way you look at it Microsoft Data Center management did not follow standards or best practices in this failure. In which case it makes me wonder more about the outsourcing of corporate data much less personal data.
- mburton325
Join the conversation here
Quick, practical advice for IT pros. Made fresh daily.
Want to cash in on your IT savvy? Send your tip to tips@itworld.com. If we post it, we'll send you a $25 Amazon e-gift card.
