Microsoft, Adobe, and MySpace - The BugBlog Report 12/11/06

Here are some of the most significant bugs from the past week in the BugBlog:

There is a new zero-day attack against Microsoft Word, apparently unrelated to the zero-day attack discussed in the 12/6 BugBlog. It affects Word 2000, 2002, 2003, and the Word Viewer 2003. However, the brand new Word 2007 is not affected. (A cynical person would say this is all a marketing ploy to get people to upgrade. Luckily, I'm not cynical.) The issue is being actively exploited, according to Microsoft. At this point, it does not appear that there will be a fix for either of these issues in time for the 12/12 Patch Tuesday Security Releases. See Microsoft's security blog for more.

Adobe says that Acrobat 7 and the Adobe Reader 7 have a number of critical bugs that need to be fixed. Attackers may be able to design a malicious PDF file that takes advantage of these to take control of your computer. Users of the free Adobe Reader 7 need to upgrade to the free Reader 8. Users of Acrobat 7.x should see the fix information for that version.

Security researchers at Websense Security Labs report on a worm that is exploiting a bug on MySpace, along with the Apple QuickTime player's support of Javascript, to infect webpages on MySpace. After the infection, links on a MySpace profile may get replaced with links to phishing sites. If you see an empty QuickTime video, or it looks like your links have been changed, you may have been infected. See WebSense for more information.

Article Author: Bruce Kratofil

Bruce Kratofil blogs on bugs and other things that can go wrong with your computer at The BugBlog, and writes about computers and economics at BJK Research

Visit Bruce Kratofil's author page — Bruce Kratofil's Blog