A flaw has been reported in Microsoft  's Jet database engine, affecting popular software applications Office and Access.
Reported by HexView, a security firm, the vulnerability is caused by a memory-handling error that can occur when doing certain tasks like parsing database files.
The flaw can be exploited to execute arbitrary code if a user opens a specially formatted file marked with an ".mdb" extension in Microsoft Access.
The Jet database is used by applications like Office 2000, Office 2003, Access 2000 and Access 2003.
The vulnerability has been confirmed on a fully patched system running Microsoft Access 2003 and Windows XP SP1 and SP2. Other versions might also be affected.
Critical Condition
Security firm Secunia has rated the flaw "highly critical" because the exploit code is in the wild.
Also, given the wide use of Office and Access -- both by corporations and by home users -- it means there is the possibility that many people could be affected if a malicious hacker chooses to use the vulnerability.
"People running Office and Access should be concerned," said Secunia researcher Thomas Kristensen.
The flaw has the potential to be exploited as well by the .mdb attachment. "It's not a common file that people watch for, like an .exe attachment," Kristensen noted. "So, it's not one that people would suspect as being malicious. And that makes it dangerous."
On the Alert
HexView noted in news reports that Microsoft was notified of the vulnerability on March 30, but has not acknowledged the flaw yet.
Microsoft issued a batch of security fixes for eight product flaws recently as part of its regular patching cycle, but the vulnerability reported by HexView was not among them.
It is unclear whether Microsoft will break from its regular patch schedule if it deems the Jet database flaw worthy of attention, but a compelling reason to do so would be the exploit code's existence in the wild.
"The code is on a public mailing list," said Kristensen. "That makes the situation different than if a security problem was found in a lab."
|
Nvidia Auto-Switches Notebook GPU To Save Battery Life
Microsoft Says Battery Woes Not Caused By Windows 7
IBM's New POWER7 Servers Save Energy with Big Loads
Intel Launches Quad-Core Itanium 9300 Series Processor
Google May Add Facebook, Twitter Links to Gmail