Windows zero-day used in Duqu infections

Researchers have figured out one way the Stuxnet-like Duqu trojan is infecting computers — via a Word document that exploits a previously unknown Windows kernel bug.

The installer file is a Microsoft Word document that exploits the kernel vulnerability, which allows code to be executed on the infected system, Symantec said in a post on its site. There may be other infection methods used by other Duqu variants that have not been uncovered yet, Kevin Haley, a director with Symantec Security Response, told ZDNet Australia‘s sister site CNET.

Microsoft is working on a fix, according to Jerry Bryant, group manager for response communications at Microsoft Trustworthy Computing — via redwolf.newsvine.com