Microsoft warns that an unpatched Word vulnerability has become the subject of targeted attacks.

The flaw - which is restricted to Microsoft Office Word 2002 Service Pack 3 - creates a mechanism for hackers to inject hostile code onto vulnerable systems. Redmond has published workarounds as a stop-gap measure while its researchers investigate the flaw in greater depth.

In the meantime, Microsoft is keen to downplay alarm. "At this time, we are aware of limited, targeted attacks attempting to use the reported vulnerability, but we will continue to track this issue," a post on its security response blog explains.

The vulnerability has appeared in a number of samples on malware. A widening number of anti-virus firms have issued signature updates to defend against the threat. Symantec, acting on samples sent to it by handlers at the SANS Institute's Internet Storm Centre, was the first to publish an advisory.

The timing of the arrival of the exploit means Microsoft had insufficient time to respond before its regular Patch Tuesday update, a factor that's unlikely to be a coincidence. The ins and out of the flaw are still under investigation and will probably be withheld until a fix is unavailable. It's also unclear who the attack is targeting, though historically unpatched Word exploits are a particular favourite of Chinese hackers. ®

Related stories

• Black hats target Windows Media Encoder bug (16 September 2008)
• Microsoft delivers four critical updates (9 September 2008)
• MS preps four critical updates for September (5 September 2008)
• Bumper Patch Tuesday plugs multiple Office flaws (13 August 2008)
• MS preps 12 fixes for August Patch Tuesday (8 August 2008)
• Microsoft probes new Office vulnerability (15 February 2007)
• Third unpatched vuln menaces Word (15 December 2006)
• Trojan targets unpatched Word flaw (again) (11 December 2006)
• Unpatched Word flaw menaces civilisation (6 December 2006)
• Analysis Targeted Trojan attacks on the rise (15 October 2006)
• Patch Tuesday omits critical Word fix (14 September 2006)
• Trojan targets 0-day Word vuln (5 September 2006)