eWeek reports that the security response team at Microsoft is investigating reports of a new zero-day attack a previously unknown vulnerability affecting Word. The vulnerability was discovered during an actual live attack by anti-virus vendor Symantec. It affects multiple versions of Microsoft Word and can be used in successful code execution attacks against users of Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP.According to an advisory from Symantec, the flaw is unrelated to the three previously known Word bugs that remain unpatched.

In the attack scenario discovered by Symantec, a rigged Word document arrives by e-mail with a lure to trick the target into opening the file. "When the infected Word document is opened, it uses an exploit to drop some files onto the computer. These files are back door Trojans that enable an attacker to gain remote access to your computer," the company warned.

Once the exploit is launched, the attacker drops a backdoor Trojan on the infected machine and immediately creates a clean Word document named "Summary on China's 2006 Defense White paper.doc." The Trojan then checks for Internet connectivity by visiting various Web sites, such as Microsoft, Google or Yahoo and opens a back door on the compromised computer. It then connects to the pop.newyorkerworld.com domain on TCP port 80 and uses the command prompt specified instructions to carry out basic operations, Symantec said. These could include logging keystrokes or hijacking sensitive documents and uploading them to a remote server.