Hackers have exploited a vulnerability discovered in Microsoft 's Word application that could allow them to remotely take control of systems, the company has warned .
The attack that is currently circulating on the internet comes with trapped documents in Rich Text Format (RTF) that exploit a vulnerability in the Word 2010 application version, according to the warning issued by the company today, Monday. The e-mails that are opened or previewed using a default setting in Outlook allow the intruder to obtain the same system privileges as the user who is logged in at that moment.
“Microsoft is aware of a vulnerability affecting supported versions of Microsoft Word,” the company says in the Security Advisory (2953095). “At this time, we are aware of limited and targeted attacks aimed at users with Microsoft Word 2010. The vulnerability could allow remote code execution if a user opens a specially crafted RTF file using a vulnerable version of Microsoft Word. The same can happen if they preview or open a specially crafted RTF file in an email message in Microsoft Outlook, and use Microsoft Word to view the e‑mail.”
The security bulletin states that Drew Hintz, Shane Huntley, and Matty Pellegrino of Google's security team discovered the vulnerability, which has been officially documented as CVE-2014-1761. Microsoft has issued a temporary fix that configures Microsoft Office to prevent RTF files from opening in supported versions of Microsoft Word. Users can also protect themselves from the exploit by viewing emails in plain text. Microsoft said it will issue an update to fix the vulnerability once the investigation is complete.
