Microsoft Word Vulnerable to Hack

Microsoft has recently issued a warning of a remote code execution vulnerability used in targeted attacks directed at Microsoft Word 2010. The software giant explained that the vulnerability allows remote code execution when you open a specially created RTF file in an affected version of Microsoft Word, or preview or open an RTF email message in Microsoft Outlook while using Word as the email viewer.


This means that if you see an incoming RTF file – just don’t open it. Actually, no one sends RFT files nowadays, so it may be a safe bet that you should not open it. In case of the successful exploit, a hacker could gain the same user rights as the current user – or that’s what Microsoft claims.

Security experts admit that Internet users whose accounts are configured in such a way that they have fewer user rights on the system would be less impacted than those with administrative privileges. However, home users would be very easy victims. Microsoft says that people are better to disable opening RTF content in Word, as this will surely prevent the exploitation of this issue through Microsoft Word.

The tech giant explained that in a web-based attack scenario, a hacker could host a site containing a webpage with a specially crafted RTF file used to try and exploit the vulnerability in question. Compromised sites and the ones accepting or hosting user-provided material or adverts might contain specially crafted material which could exploit this vulnerability.

Microsoft says that an attacker would have no way to force people to visit those sites, but rather would have to convince them to visit the site, normally by getting users to click a link in an email message or Instant Messenger message taking them to the attacker’s site. The experts point out that the vulnerability could be exploited via Microsoft Outlook only when using Microsoft Word as the email viewer. In fact, Word is the default email reader in Microsoft Outlook 2007, Microsoft Outlook 2010, and Microsoft Outlook 2013.

In form of an initial workaround until the flaw is eliminated, the company is providing a Fix-it automated instrument. The latter uses Office’s file block feature and adds some registry keys to prevent opening of RTF files in all Word versions.