A new zero-day exploit for Microsoft Word has been discovered that allows attackers to infect a machine with malware through e-mail attachments. Discovered by research firm FireEye, an attacker can send a malicious Microsoft Office RTF file to a user and, if opened, it will execute a Visual Basic script that has malicious code embedded, which then connects to known malware families.
The attack has been found to be being used openly in the wild and Microsoft has been aware of the issue for several weeks. The company has been working with FireEye to discuss a time to publicly disclose the issue and to create a patch, however, FireEye took the decision to disclose it earlier after another company similarly disclosed the same issue.
The only way of staying safe from this attack vector is to not open any suspicious e-mail attachments and, if possible, keep any attachments in the Protected view, as this prevents the arbitrary code from executing on the machine.
source:onmsft
