Microsoft has a Zero Day and is seeing active attacks in the Middle East and South Asia, researchers said.
The vulnerability is a remote code execution vulnerability that exists in the way affected components handle specially crafted TIFF images The vulnerability is present in Microsoft Office 2003, 2007 and 2010 and some of the older Windows Operating Systems, and the attack vector is through Microsoft Word Documents.
Microsoft has provided a Fix-It that turns off TIFF rendering in the affected graphics library, which should have no impact if you are not working with TIFF format files on a regular basis. The software giant released security advisoryabout the vulnerability (CVE-2013-3906). The listed software packages are not vulnerable under all conditions, so it is important to understand the exposure.
Microsoft’s proactive security toolkit EMET (Enhanced Mitigation Experience Toolkit) prevents the attack from executing, as do some of the Office 2010 security measures, such as Protective Mode. Microsoft has provided more information in a blog post on their SRD Blog.
Microsoft released this statement regarding the vulnerability:
“Microsoft is investigating private reports of a vulnerability in the Microsoft Graphics component that affects Microsoft Windows, Microsoft Office, and Microsoft Lync. “Microsoft is aware of targeted attacks that attempt to exploit this vulnerability in Microsoft Office products.
“The vulnerability is a remote code execution vulnerability that exists in the way affected components handle specially crafted TIFF images. An attacker could exploit this vulnerability by convincing a user to preview or open a specially crafted email message, open a specially crafted file, or browse specially crafted web content. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
“We are actively working with partners in our Microsoft Active Protections Program (MAPP) to provide information that they can use to provide broader protections to customers. For information about protections released by MAPP partners, see MAPP Partners with Updated Protections.
“Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This may include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs.”