Microsoft refutes exploit-site reports of Office flaws
The same week Microsoft released April's second Patch Tuesday distribution, a hacker claimed on exploit websites to have found a number of application flaws. Microsoft today said it has found no such vulnerabilities.
The hacker, using the moniker Muts, said he found a number of file format bugs in just three hours. He acknowledged the bugs on the Milw0rm and Security Vulnerabilities websites.
However, a Microsoft spokesman said the company is investigating the reports. initial inquiries have found no flaws in Word 2007 or Office 2007. The investigation is ongoing, according to the spokesperson.
Microsoft is not aware of any attacks targeting the reported flaws, the spokesperson said.
On Tuesday, Microsoft released five fixes for eight server- and client-side vulnerabilities that could lead to attackers executing arbitrary code.
The most pressing fix released was MS07-021, which fixes a privilege escalation flaw in Microsoft Client/Server Runtime Server Subsystem (CRSSS) and affects all operating system versions, including Vista.
Last Tuesday, Microsoft released an emergency, out-of-cycle patch for a vulnerability in the way Windows handles ANI files, a flaw being exploited by thousands of malicious sites.
Amol Sarwate, director of Qualys’ vulnerability research lab, told SCMagazine.com today that exposure of flaws around Patch Tuesday has become the norm in recent months.
"No, this is not really unusual. What we have seen the past few Patch Tuesdays is that there are vulnerability announcements right before and right after, so it gives vendors very little time to react," he said.