Blog: Patch Tuesday October 2012 - More Microsoft Word Spearphish Risks
Today's Microsoft updates include a few fixes for remote code execution, and several fixes for escalation of privilege and denial of service flaws. The priority for both general folks running Office on their personal computer or corporate cumstomers this month will be to roll out MS12-064 effecting Microsoft Office. Vulnerability CVE-2012-2528 is patched by this bulletin, and predictably will be attacked with more code in malformed rtf format documents, which have been delivered as .doc files, in much the same manner as CVE-2012-0158. This vulnerability has been heavily implemented in spearphish in a large variety of serious targeted attacksthis summer. Accordingly, expect to see more of these new vulnerabilitiues targeted by spearphish from the APT. Another vulnerability in Word is being patched, but is very difficult to reliably exploit.
Source:
Blog: Patch Tuesday October 2012 - More Microsoft Word Spearphish Risks
