Virus writers are actively exploiting a memory corruption vulnerability in Microsoft Word that was patched on Tuesday, researchers said yesterday.
The flaw, which, according to Microsoft, was being exploited in targeted attacks prior to Tuesday's fix, is rated "extremely critical" by vulnerability tracking firm Secunia. It affects Microsoft Office 2000, Office XP and Office 2004 for Mac.
Users' machines can be compromised if they open an Office file that contains the memory corruption error, according to the Secunia advisory. The exploit drops a trojan, dubbed Mdropper.Z by Symantec.
Alfred Huger, vice president of engineering in Symantec Security Response, said that this scenario is nothing new. Once attackers realise their discovery has been patched, they either start spreading the attack in a widespread manner or sell the exploit code to interested buyers. Word is an attractive target, he said.
"It has a tremendously large user base," Huger said. "We normally see any user application that has a large footprint like this is going to be targeted first [after Patch Tuesday]."
Symantec researchers have only received one in-the-wild attack submission from a customer, but they believe the exploit is being heavily distributed.
A Microsoft spokesperson could not immediately be reached for comment.