Microsoft Word Warning: Flaw Could Let Attackers Control Your PC

A recently-discovered vulnerability in Microsoft Word could leave your PC open to attack, even if you simply preview an infected  e-mail.  This attack targets Word 2010 and comes in the form of a rich text file, which is identified by the .rtf at the end.

The scary part is that you could activate this bug simply by previewing an e-mail. Word is your default document viewer in Outlook 2007, 2010 and 2013.

An attacker could use this to gain control of your computer by executing remote code. The RTF-formatted data can corrupt system memory and then execute arbitrary code.  An attacker could also set up a website to host that specially-crafted file or make that file part of a post or advertisement on websites that accept user-based content or advertisement.

Now, the attacker would have to convince you to come to the site using a link in an e-mail or a message.  There’s a long list of affected Word programs:

• Microsoft Word 2003 Service Pack 3
• Microsoft Word 2007 Service Pack 3
• Microsoft Word 2010 Service Pack 1 (32 & 64-bit editions)
• Microsoft Word 2010 Service Pack 2 (32 & 64-bit editions)
• Microsoft Word 2013 (32 & 64-bit editions)
• Microsoft Word Viewer
• Microsoft Office Compatibility Pack Service Pack 3
• Microsoft Office for Mac 2011
• Word Automation Services on Microsoft SharePoint Server 2010 (Service Pack 1 & 2)
• Word Automation Services on Microsoft SharePoint Server 2013
• Microsoft Office Web Apps 2010 (Service Pack 2 & 2)
• Microsoft Office Apps Web Server 2013

Microsoft has offered up a Fix-It-For-Me Option here. This fix blocks Rich Text Files from your computer. There’s also the option of disabling the fix, should you need to open a rich text file.

If you use the Outlook e-mail client, you can change your settings to read incoming e-mails as plain text to protect yourself.  In Outlook, go to File and then choose options.

An options window will open. Choose Trust Center from the column on the left.

Then select Trust Center Settings at the bottom right of the window.

Another window will open and you’ll choose E-mail Security from the column on the left.

Check the tick box beside Read all standard main in plain text. Then hit Okay.

If there are any rich text files you absolutely need to open, make sure you scan them with your security program. Microsoft is working on a permanent fix for this issue. This is a good time to point out that security support for Word 2003 ends on April 8, 2014 along with support for Windows XP That means that if a bug like this turned up that was affecting only Word 2003 after that date, Microsoft security experts would not be working to find a way to permanently fix the issue.

~ Cynthia