Bugs and Fixes: Problems All Around With Microsoft Software

Fix weak links in popular programs before your PC comes under attack.

Stuart J. Johnston is a contributing editor for PC World. Click here to view past Bugs and Fixes columns.

Month after month, I report on the latest problems with Internet Explorer and Windows. You might think that these are the only pieces of software at risk, and they are often under constant scrutiny (see "In Brief"). But don't assume that you're covered after plugging holes in the usual suspects. This month, Microsoft Office is vulnerable--along with a host of other programs--due to three newly discovered holes.

The first flaw affects any program that uses Visual Basic for Applications--a programming language common to all Office apps, as well as Publisher, Visio, and others.

Microsoft didn't make VBA bulletproof. It has an "unchecked buffer" that, if exploited by malicious code, could let an attacker take over your PC. Buffer checkers are like the safety cutoff valves in self-serve gasoline pumps. When your tank--or in this case, a buffer meant to hold data until it's needed--is full, the pump automatically shuts off. But the VBA buffer lacks a shutoff valve. In theory, a miscreant may send you a malformed PowerPoint file, say, containing an attack macro capable of sending too much data to the buffer. If you load the file, the macro begins to execute. As the data overflows, the cracker's code moves to take over. See this Microsoft bulletin for a list of affected programs and a link to the fix.

The other two flaws affect Word (versions 97 through 2002) and Works Suite (versions 2001 through 2003). One of them involves macros. If you open a Word file containing a nasty macro, it can execute automatically and cause a lot of damage. Jump to Microsoft's site to get the patch.

The final vulnerability affects Corel WordPerfect word processor documents. If you need to be able to read WordPerfect files within Microsoft Word, you probably use Microsoft's file converter. But the converter has a hole consisting of another unchecked buffer that a miscreant could misuse by sending you an infected WordPerfect file. Again, at Microsoft's site you can download the patch and read details about other susceptible programs.

Virus Alert: Reader Spots Faux Fix

I just received two identical e-mail warnings from the "Microsoft Network Security Division." The messages said that they contained a "Current Microsoft Critical Patch." I once read in your column that Microsoft never sends out patches in e-mail, so it was clear that this was a phony.

Kenneth Allison, Hereford, Arizona

Allison avoided the latest sham e-mail message making the rounds. The e-mail in question uses text that closely resembles a genuine Microsoft security alert. But the attached file, described in the e-mail as a "cumulative patch" for Outlook, Outlook Express, and IE, actually contains the Swen virus. The new worm exploits a hole in Outlook and OE that Microsoft patched two years ago. Read Microsoft's advice on how to defeat Swen.

In Brief

New IE Update

Microsoft released its umpteenth cumulative patch for IE (labeled 828750), which includes fixes for several new security holes.

Access Attacks

If you use Microsoft's Snapshot Viewer to look at data from an Access database, you need a patch to keep snoops from peeking at your data.

IBM Recall

Big Blue is recalling approximately 118,000 G51 and G51t 15-inch CRT monitors built between June 1997 and September 1998, due to a fire hazard. Browse to IBM's site to learn how to tell whether your monitor should be inspected--and possibly repaired.

Bugged?

Found a hardware or software bug? Tell us about it via e-mail at bugs@pcworld.com.