In any field, people have heard that its better to spend the time to fix the root cause of a problem than to just address the symptoms. It’s not just common sense, but it costs lest in the long run too. You’d think the largest software maker in the world, would have this drummed into their collective brain by now, but you’d be wrong. Microsoft admitted that it had not patched a bug in its Jet Database Engine (I believe this is the black heart of MS Access) that it knew about since 2005 because it had already blocked the attack vectors it knew about.
But the company hadn’t thought of the attack strategy now being used by hackers. "Everything changed with the discovery of this new attack vector that allowed an attacker to load an .mdb file via opening a Microsoft Word document," he said. "The previous guidance does not work against this new attack. So that’s why we alerted customers to these attacks and are re-investigating Jet parsing flaws — this is a new attack vector discovered that we didn’t know about."
MS Rep claims that they can’t fix the .mdb file format, because its designed to run code. But there should be some way to sand box the code that gets executed, ala javascript and flash. Plus, we’re supposed to believe MS can’t force their users to upgrade to a new file format in MS Office?
HT: cgisecurity.com