Flaw found in older Office versions
Microsoft blasts bug's discoverer for not bringing it to company's attention before going public.
Secunia issued an advisory saying a buffer overrun flaw has been found in Office 2000, and potentially also in Office XP, that could allow hackers to take over a user's system. The company rated the flaw as "highly critical."
The security firm said that vulnerability is caused by an error in the way Microsoft Word manages input when parsing document files. It said the flaw could be exploited through a specially-crafted document and recommends that, until a fix is found, users only open trusted Word documents.
Microsoft said it was investigating the issue, but also took to task the bug's discoverer--which Secunia identified only as "HexView"--for not bringing it to Microsoft's attention before going public.
"We have not been made aware of any active exploits of the reported vulnerabilities or customer impact at this time, but we are aggressively investigating the public reports," a Microsoft representative said in an e-mail. But the software maker said it was concerned that it had not been made aware of the flaw prior to it being made public.
Some in the security community have taken Microsoft to task for the time it takes to develop patches.
Microsoft said that once it completes its investigation, it will decide what, if any, action to take. Options include a fix as part of the company's regular monthly patch releases or an unscheduled fix if the vulnerability warrants it.