by Jeremy Kirk

Trojan uses unpatched Microsoft Office hole

news
Oct 3, 20051 min

Backdoor.Hesive can allow an unauthorized user access

Microsoft said Monday it is investigating a recently released Trojan horse that targets a hole in its Microsoft Office software suite that was first identified in April.

Symantec has issued an advisory that the Trojan, named Backdoor.Hesive, can arrive as a Microsoft Access file, exploiting a Microsoft Jet Database Engine buffer overflow. The code can allow an unauthorized user access, Symantec said, allowing an intruder to upload files, modify registry values and get system and network information.

A Microsoft spokeswoman wrote in an e-mail response Monday that the company is encouraging users to be cautious when opening .mdb files from an unknown source. A patch has not been released yet, according to the company.

The Trojan is not widely distributed and can be easily removed, Symantec said. The company rated its damage potential as “medium.”

The flaw in Microsoft Office was first identified in April by HexView, a computer security firm. The vulnerability is caused by a memory handling error when parsing database files, HexView reported. The Trojan can be triggered after a user opens an affected .mdb file in Microsoft Access, according to an advisory issued by Secunia, a security firm, in April.