A vulnerability found in Microsoft’s Jet Database Engine — the engine that shares data between Microsoft Office products and other apps — has been confirmed by Microsoft to be the area of exploit for a recent round of attacks.
Windows Vista users aren’t vulnerable, as the operating system includes an updated version of the Jet Database Engine, but XP users could likely be attacked. According to Microsoft…
Customers running Windows Server 2003 Service Pack 2, Windows Vista, and Windows Vista Service Pack 1 are not vulnerable to the buffer overrun being attacked, as they include a version of the Microsoft Jet Database Engine that is not vulnerable to this issue.
Customers using Microsoft Word 2000 Service Pack 3, Microsoft Word 2002 Service Pack 3, Microsoft Word 2003 Service Pack 2, Microsoft Word 2003 Service Pack 3, Microsoft Word 2007, and Microsoft Word 2007 Service Pack 1 on Microsoft Windows 2000, Windows XP, or Windows Server 2003 Service Pack 1 are vulnerable to these attacks…
…At this time, we are aware only of targeted attacks that attempt to use this vulnerability. Current attacks require customers to take multiple steps in order to be successful; we believe the risk to be limited.
Microsoft Security Advisory (950627) [Microsoft.com] via ZDNet
