The Cloud Consultancy Europe Ltd.
+44 (0) 203 637 6667 [email protected]

Users of Microsoft Office are being warned of a new zero-day security flaw that has been exploited since at least January.

The security flaw enables attackers to covertly install malware on PCs by exploiting flaws in Microsoft’s Object, Linking and Embedding (OLE) technology.

Security researchers at McAfee have been first off the mark among security vendors, publishing a blog on the vulnerability.

The security group claims that it intercepted suspicious Microsoft Word Rich Text Format (RTF) format documents that, when opened, run the exploit. This connects to a remote server in the background and downloads a file that contains a HTML application content file that looks like a Microsoft document, but executes it as an .hta file.

The .hta file enables the attacker to gain full administrator rights on the victim’s machine.

“The successful exploit closes the ‘bait’ Word document, and pops up a fake one to show the victim. In the background, the malware has already been stealthily installed on the victim’s system,” McAfee warned.

It added that the root cause of the zero-day vulnerability is related to the Windows OLE feature in Windows, that Microsoft Office takes advantage of.

Security researchers at FireEye said that they also recently detected malicious Microsoft Office RTF documents that leverage a previously undisclosed vulnerability. They added that the vulnerability enables attackers to download and execute malware payloads from different well-known malware families.

The security company said it had been in contact with Microsoft about the vulnerability for several weeks, but did not publicly disclose any details until McAfee decided to reveal all in its blog post.

McAfee warns users to not open Office files obtained from untrusted sources. It added that the attack cannot bypass the Office Protected View, so suggested that all users turn this feature on.