New Microsoft Word 2000 Vulnerability

We’ve seen many threats using vulnerabilities based on MicrosoftOffice documents over the last year, so it’s no surprise that we haverecently observed new samples of a threat that follows the same theme.This threat named Trojan.Mdropper.W is using the new Microsoft Word 2000 Unspecified Code Execution Vulnerability (BID22225)to drop threats onto a compromised computer. When the infected Worddocument is opened, it uses an exploit to drop some files onto thecomputer. These files are back door Trojans that enable an attacker togain remote access to your computer.

This vulnerability comes on the back of three other recent and unpatched Microsoft Word vulnerabilities, which are:

BID21518 (CVE-2006-6456)
BID21451 (CVE-2006-5994)
BID21589 (CVE-2006-6561)

To protect yourself against these threats, do not trust unsolicitedfiles or documents about “interesting” topics. Do not open attachmentsunless they are expected and come from a known and trusted source.