Microsoft warns of targeted attacks exploiting Windows flaw

With the April Patch Tuesday, Microsoft has issued six bulletins – four critical, two important – and has delivered patches for 11 vulnerabilities.

One particular bulletin (MS12-027) stands out and patching the vulnerability (CVE-2012-0158) documented in it should be considered a priority, as Microsoft shared that it is currently being exploited in the wild.

The flaw is in Windows Common Controls ActiveX control and consequently affects a great many Microsoft products such as Office 2003 through 2010 on Windows, SQL Server 2000 through 2008 R2, BizTalk Server 2002, Commerce Server 2002 through 2009 R2, Visual FoxPro 8 and Visual Basic 6 Runtime.

“The vulnerability could allow remote code execution if a user visits a website containing specially crafted content designed to exploit the vulnerability,” says Microsoft.

“In all cases, however, an attacker would have no way to force users to visit such a website. Instead, an attacker would have to convince users to visit the website, typically by getting them to click a link in an email message or Instant Messenger message that takes them to the attacker’s website.”

“The malicious file could be sent as an email attachment as well, but the attacker would have to convince the user to open the attachment in order to exploit the vulnerability.”

Microsoft didn’t go into details about how the vulnerability was discovered – it simply says that its existence has been “privately disclosed”.

This is one of the rare times where the patching of a flaw that has nothing to do with Internet Explorer has been deemed more important than applying the cumulative patch for the company’s browser.

“We list MS12-027 as our highest priority security update to deploy this month because we are aware of very limited, targeted attacks taking advantage of the CVE-2012-0158 vulnerability using specially-crafted Office documents,” stated Elia Florio, a Microsoft Security Response Center engineer.

Microsoft Word 2010 users are partly protected by the product’s Protected View, and the danger of attack can be mitigated by disabling ActiveX controls. Still, applying the patch is the best course of action.