Zero-Day Word Exploit Not Addressed in "Patch Tuesday Lite"
Microsoft issued three patches for security vulnerabilities yesterday, including one for a critical flaw in Office Publisher that could let attackers take control of affected systems. In addition to the low patch count, what was notable about yesterday's release of patches was the lack of a patch for the memory corruption flaw in Word 2000 that led to the zero-day "MDropper.Q" Trojan over the Labor Day weekend. Meanwhile, malware writers continue to target the vulnerabilities Microsoft fixed last month.
When Microsoft issued its monthly pre-release security patch advisory late last week, the vendor said to expect three patches, including one critical patch, and one for a flaw in Office. Many assumed that meant Microsoft would be addressing the vulnerability exploited by the MDropper.Q" Trojan, a so-called "zero-day" exploit because the malware and the underlying security vulnerability were discovered at the same time.
