Beware: Zero-day follows Patch Tuesday
On Tuesday Microsoft released its newest security patches. Most of the patches dealt with vulnerable places in Microsoft programs which were know to have been used. Wednesday, the day following, is now Zero-day for new cyber-attacks. These will not be fixed for a month.
Microsoft has warned that a new, yet-to-be-patched security hole in Word is being used in targeted cyber-attacks. And that warning came on Zero-day, the day after Patch Tuesday, so you will not get a patch for four weeks.
Microsoft said in a security advisory posted late Wednesday that when a user opens a rigged Word file, it may corrupt system memory in such a way that an attacker could gain complete control over the PC. The programs at risk are Office 2000 and Office XP. The two recent versions, Office 2003 and 2007, are not affected.
Once again, these attacks do not materialize from thin air. They will come, most likely, as attachments to an email. So you should not open attachments unless you are very, very sure of the sender. And perhaps not even then.
This vulnerability is being exploited but, according to Microsoft, in ‘very limited, targeted attacks.’ Which seems likely. And Microsoft will issue a patch. But not today. Not this week. Next Tuesday month. The day before the next Zero-day when the happy cycle will start again.
This is an increasing and slightly worrying trend. With the new updates released this Microsoft blocked five Zero-day flaws. That is security holes that have been publicly disclosed but not fixed.
The problem is that these are ideal for targetted attacks on a specific business and, typically, will not be blocked by any existing anti-virus software.
Cybercrooks now wait for Patch Tuesday and strike the day after: Zero Day Wednesday.
Does it involve the average user? Hardly. These short term vulnerabilities are used to attack major but defined targets. Not your happy home user. But it shows, once again, that cyber-crooks are pretty damned smart. And evil.
Related Posts:
