Trojan targets 0-day Word vuln

Osiris · 09-05-2006, 07:58 PM

An unpatched Microsoft Word 2000 vulnerability is being actively exploited by hackers to spread malware.

The MDropper-Q Trojan downloader, recently detected by Symantec, takes advantage of the unspecified zero-day vuln to load other malware onto compromised PCs, including a backdoor Trojan called Backdoor-Femo, which surrenders control of compromised PCs to hackers. The attack is dangerous but not, as yet, widespread.

Documents incorporating the exploit code must be opened with a vulnerable copy of Microsoft Word 2000 for the attack to succeed, so the exploit doesn't lend itself towards the creation of self-replicating network worms.

Users are advised not to open untrusted documents until Microsoft patches the vulnerable software, in this case Word and Office 2000. Symantec is holding back on releasing details of the vulnerability pending a fix from Microsoft.

A previous version of MDropper attempted to target users of Microsoft's Office 2003 suite of applications. As Symantec notes: "Microsoft Office vulnerabilities are a great platform for social engineering and email based attacks."

http://www.theregister.com/2006/09/05/ms_office_trojan/

talldude123 · 09-05-2006, 10:26 PM

It's a good thing that I have upgraded to Office XP. Most others are in the 2003/Office 12 Era as well.

I dont even know if Office 2000 works with Windows XP.

Jam3s-Zer0 · 09-06-2006, 02:21 AM

It does, I used to have it.

09-05-2006, 07:58 PM	#1 (permalink)
Osiris Security/Hacking Mod Join Date: Jan 2005 Location: USA Posts: 24,120	Trojan targets 0-day Word vuln An unpatched Microsoft Word 2000 vulnerability is being actively exploited by hackers to spread malware. The MDropper-Q Trojan downloader, recently detected by Symantec, takes advantage of the unspecified zero-day vuln to load other malware onto compromised PCs, including a backdoor Trojan called Backdoor-Femo, which surrenders control of compromised PCs to hackers. The attack is dangerous but not, as yet, widespread. Documents incorporating the exploit code must be opened with a vulnerable copy of Microsoft Word 2000 for the attack to succeed, so the exploit doesn't lend itself towards the creation of self-replicating network worms. Users are advised not to open untrusted documents until Microsoft patches the vulnerable software, in this case Word and Office 2000. Symantec is holding back on releasing details of the vulnerability pending a fix from Microsoft. A previous version of MDropper attempted to target users of Microsoft's Office 2003 suite of applications. As Symantec notes: "Microsoft Office vulnerabilities are a great platform for social engineering and email based attacks." http://www.theregister.com/2006/09/05/ms_office_trojan/ __________________ www.MasterB365.com www.MasterB-Outdoors.com

09-06-2006, 02:21 AM	#3 (permalink)
Jam3s-Zer0 Ultra Techie Join Date: Feb 2006 Posts: 838	It does, I used to have it. __________________

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

09-05-2006, 10:26 PM	#2 (permalink)
talldude123 Banned Join Date: May 2005 Posts: 7,947	It's a good thing that I have upgraded to Office XP. Most others are in the 2003/Office 12 Era as well. I dont even know if Office 2000 works with Windows XP.